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FROM  THE  EDITOR 


My  Bathroom 

And  why  you  should  care  about  it 

I  never  gave  much  thought  to  my  bathroom 
until  water  started  dripping  out  of  the  recessed 
lights  in  the  kitchen  below  it.  Naturally,  I  called  a 
plumber.  He  told  me  that  my  legacy  system  was  no 
longer  sufficiently  robust  to  support  washing  and 
waste  disposal  activities.  And  due  to  the  inflexible 
nature  of  the  bathroom’s  infrastructure,  it  would 
need  a  soup-to-nuts  upgrade  to  version  2.0.  That 
would  entail  a  total  curtailment  of  functional  pro¬ 
cesses  for  the  duration  of  the  project  (estimated  to 
be  six  weeks)  and  a  major  financial  investment  of  scarce  resources. 

(What  he  actually  said  was  close  to  incomprehensible,  as  his  English  was  rudi¬ 
mentary  at  best,  but  the  gravity  of  the  situation  and  the  comprehensiveness  of  his 
analysis  became  crystal  clear  when  he  presented  his  estimate  for  the  job.) 

After  the  room  was  reduced  to  rubble,  after  the  ceiling,  walls,  floor  and  fixtures 
disappeared,  the  infrastructure  was  revealed  in  all  its  dysfunctional  glory. 

Complicated?  I  had  no  idea.  Pipes  twisted  up,  down  and  all  around,  taking  odd 
turns  to  avoid  old  studs  and  ancient  beams,  rusting  ducts  and  clogged  vents.  Iron 
pipe  gave  way  to  copper,  which  in  turn  gave  way  to  PVC  (from  an  upgrade  made 
prior  to  my  acquisition  of  the  premises).  Wires  snaked  and  coiled  everywhere. 

One  should  never  have  to  see  the  guts  of  one’s  domicile  exposed  like  that. 

Similarly,  a  business  doesn’t  want  to  know  about  the  infrastructure  or  IT  archi¬ 
tecture  that  supports  its  business  processes.  All  it  wants  is  hot  and  cold  running 
apps  when  it  turns  on  the  IT  faucets.  It  wants  the  new  geegaws  that  enable  it  to  do 
business  faster,  more  easily  and  above  all,  more  profitably. 

The  problem  is,  each  new  gadget,  each  new  application,  each  new  product, 
process  or  function  adds  complexity  that  stresses  the  legacy  system  and  strains 
the  CIO’s  carefully  constructed  architecture— and  his  scarce  resources— until... 
you  spring  a  leak  and  have  to  shut  down. 

I  assure  you  from  bitter  (and  grungy)  experience,  you  don’t  want  to  go  there. 

I  might  have  avoided  my  bathroom  disaster  had  I  taken  steps  before  the  leaks 
began.  You  can  avoid  some  of  the  costs  of  IT  complexity  if  you  start  now,  making 
process  central  to  your  technology  strategy,  communicating  with  the  business  in 
an  open  and  predictable  manner,  keeping  an  eye  on  signs  that  your  legacy  systems 
are  holding  you  back,  not  pushing  you  forward.  Nothing  about  this  is  simple,  but 
our  cover  story,  “Cures  for  Complexity”  (Page  46),  suggests  ways  to  begin. 


David  Rosenbaum,  Editor 

drosenbaum(5)cio.com 
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FROM  THE  PUBLISHER  EMERITUS 


All  About  the  Links 

I’ll  show  you  my  connections  if  you  show  me  yours 


A  friend  of  mine  recently  sent  me  a  link  to  his 
Facebook  account  and  encouraged  me  to  join. 

I  just  couldn’t  do  it.  Facebook  seems  to  me 
to  belong  in  the  same  general  category  as  Tom 
Wolfe’s  best  seller,  I  Am  Charlotte  Simmons,  about 
a  young  woman  who  discovers  that  college  is  all 
about  booze,  sex  and  bad  behavior.  Facebook,  I 
thought,  is  the  domain  of  Gen  Y.  Boomers  like  me 
need  not  apply. 

But  his  e-mail  did  have  an  effect  on  me. 

The  very  next  day,  I  received  another  one  of  those  annoying  invitations  from 
a  colleague  encouraging  me  to  join  his  Linkedln  network.  And  even  though  over 
the  past  few  years  I  have,  as  a  matter  of  habit,  ignored  these  invites  from  people  I 
know  (and  often  from  people  I  don’t),  this  time,  perhaps  inspired  by  my  brush  with 
Facebook,  I  said  to  myself,  “Why  not?”  and  accepted.  And  surprise,  surprise,  I  had 
forgotten  that  I  had  registered  as  a  member  of  the  Linkedln  community  about  a 
year  ago  and  had  about  150  standing  invitations  to  get  connected. 

Over  one  weekend,  I  dived  deep  into  Linkedln  and  I  was  impressed.  I  connected 
with  business  colleagues  and  business  friends,  some  whom  I  had  not  communi¬ 
cated  with  in  more  than  10  years. 

Want  to  have  some  fun?  Using  me  as  your  direct  or  second-level  contact  (since 
we’re  all  members  of  the  greater  CIO  community,  yes?),  let’s  build  the  largest  audi¬ 
ence  of  C-level  execs  on  Linkedln. 

If  you’re  a  CIO,  CTO  or  CSO,  and  a  member  of  Linkedln,  invite  me  to  join  your 
network.  If  you  want  to  join,  but  aren’t  a  Linkedln  member,  go  to  www.linkedin 
.com,  register  and  then  send  me  an  invite. 

I  will  not  block  my  “connections”  link  on  my  account,  so  anyone  who  links  to 
me  will  be  able  to  see  all  my  C-level  contacts. 

Let  Gen  Y  have  Facebook;  I  will  take  my  Linkedln  network. 

I  look  forward  to  linking  with  you. 


Gary  Beach,  Publisher  Emeritus 

gbeach@cio.com 
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offers  an  easy  way  to  make  applications  more  valuable.  Embed  our  rapid  integration 
platform  in  your  applications,  and  they  will  easily  connect  with  the  existing  systems 
of  your  customers  and  prospects.  Plus,  Ensemble  enables  you  to  enrich  legacy 
applications  with  adaptable  workflow,  browser- based  user 
interfaces,  rules-based  business  processes,  and  other  new 
features  that  users  want  -  without  rewriting.  Embed  our 
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Can  You  Outsource 
Innovation? 

What  a  great  topic!  My  experience 
on  this  [“What  Does  It  Take  to  Get 
IT  Outsourcers  to  Innovate,”  Oct.  15, 
www. cio. com/article/144400]  reveals 
a  few  essential  truths: 

1.  Despite  the  rhetoric,  clients  are 
generally  unwilling  to  pay  for  inno¬ 
vation  that  takes  the  form  of  process 
improvement.  For  this  reason,  it  is 
essential  to  gain  clarity  on  how  inno¬ 
vation  is  defined  within  the  specific 
context  of  a  client-provider  relation¬ 
ship,  and  in  terms  that  relate  to  value- 
creation  for  the  client; 

2.  A  client  should  select  a  service 
provider  based,  in  part,  on  the  ability 
of  the  relationship  (not  only  the  pro¬ 
vider,  but  the  combination  of  client  + 
provider)  to  create  value  “outside  the 
box”  of  the  outsourcing  scope; 

3.  There  must  exist  specific  shared 
accountabilities  for  bringing  innova¬ 
tion  candidates  to  the  table.  This  is 
not  a  matter  left  to  the  delivery  teams 
alone.  This  is  a  topic  requiring  “inter¬ 


vention”  at  a  regular  tempo— looking 
for  opportunities  to  deliver  break¬ 
through  capability;  and 

4.  The  investment  models  for  inno¬ 
vation  must  vary  by  circumstance. 
The  client  and  provider  should  agree 
on  risk/reward  terms  through  an 
informed  dialogue  around  roles  and 
responsibilities  for  achieving  a  new 
level  of  performance  that  is  far  from 
“business  as  usual.” 

"There  must  exist 
specific  shared 
accountabilities 
for  bringing 
innovation 
candidates  to 

the  table."  -Peter  Allen 

The  good  news:  There  are  emerging 
examples  of  progressive  approaches 
to  innovation  through  outsourcing, 
and  great  contractual  frameworks  to 
support  attainment  of  a  widened  risk- 
reward  window. 

But  remember  that  win-win  implies 
that  lose-lose  is  also  possible. 

PETER  ALLEN 


Falling  Dollar,  Rising 
Rupee 

Very  timely  and  appropriate  article 
[From  “Rising  Rupee  Rocks  All  Boats,” 
Nov.  1,  www.cio.com/article/1434SO], 
The  fall  in  the  dollar  and  the  rise  in 
South  Asian  currencies  (not  just  rela¬ 
tive  rise)  are  fundamentally  changing 
the  economics.  Larger  outsourcers 
with  good  treasury  departments  are, 
of  course,  hedged  against  the  depreci¬ 
ating  dollar.  But  there’s  a  limit  to  how 


long  that  benefit  will  last. 
MARKDENNE 


Successful  Skills  for  CIOs 

I  read  with  interest  the  article  on 
the  future-state  CIO  model  in  the 
July  1st  issue  of  CIO  magazine.  The 
results  compare  favorably  with  our 
own  research  at  Santa  Clara  Univer¬ 
sity.  Ten  years  ago,  we  undertook  a 
research  study  to  understand  what 
CEOs  expected  of  their  IT  lead¬ 
ers.  The  results  were  subsequently 
published  in  Business  Horizons  [www 
.cse.scu.edu/~rdaniels/html/research/ceos 
,html\.  Essentially,  CEOs  told  us  that 
their  IT  leader  needed  to  have  the  same 
skills  that  they  themselves  possessed. 
Universally,  they  commented  that  their 
CIO  did  not  have  these  skills. 

Subsequently,  we  looked  around 
to  see  where  aspiring  CIOs  might 
acquire  the  skills  that  CEOs  said  they 
needed  to  have.  We  found  many  uni¬ 
versities  and  training  organizations 
did  indeed  teach  many  of  the  desired 
skills,  but  there  was  nowhere  in  the 
country  at  that  time  that  they  could 
learn  these  skills  in  a  setting  with 
other  IT  professionals.  We  felt  the  lat¬ 
ter  was  important  for  the  learning  that 
would  flow  from  their  peers,  and  also 
to  provide  a  “support”  environment 
in  which  the  IT  people  could  openly 
share  their  concerns  with  one  another. 
Our  deliberations  subsequently  led  us 
to  develop  the  IT  Leadership  Program, 
which  is  now  in  its  ninth  year. 

Your  research  does  a  wonderful  job 
of  further  specifying  the  skills  that 
successful  CIOs  need  to  have.  I  would 
only  add  that  the  understanding  of 
what  it  means  to  be  a  “strategic”  CIO 
is  still  very  lacking.  “Strategic  orienta- 
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THOUGHTS  ON  THE  EVOLUTION 
OF  THE  DATA  CENTER 


Should  I  design 
my  data  center 
around  my  data, 
or  their  network? 
That’s  easy. 
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BROCADE 


INTRODUCING  THE  BROCADE  DCX. 

There  are  two  very  different  visions  for  how  the  world’s  data  centers  will  evolve.  For  some,  the  decision 
is  easy.  With  the  new  Brocade  DCX  '  as  the  foundation,  you  can  evolve  your  data  center  around  your 
applications  and  your  data.  The  result?  You  can  dramatically  improve  efficiency  while  reducing  cost  and 
risk — building  on  the  technology  you  already  own.  Get  the  free  white  paper  at 


unicatibrtS  Systems,  Inc.  All  rights  reserved.  Brocade  is  a  registered  trademark,  and  the  B-v/ing  symbol  and  DCX  are 
ations Systems,  me. 


InBox 


"CEOs  told  us 
that  their  IT 
leader  needed  to 
have  the  same 
skills  that  they 
themselves 
possessed." 

-PeterS.  Delisi 

tion”  is  necessary,  but  not  sufficient, 
for  becoming  a  CIO  who  understands 
and  can  use  IT  to  influence  the  busi¬ 
ness  strategy  of  the  enterprise. 

In  addition  to  my  work  with  the  IT 
Leadership  Program  at  Santa  Clara 
University,  I  have  been  a  strategy  con¬ 
sultant  to  major  corporations  for  the 
past  20  years.  What  I  have  learned  is 
that  there  is  a  major  difference  between 
the  ability  to  think  strategically  and 


the  ability  to  translate  that  thinking 
into  execution.  Many  senior  executives 
are  brilliant  strategic  thinkers— able 
to  think  about  their  customers,  mar¬ 
kets,  products  and  competition— but 
the  research  shows  that  these  same 
thinkers  are  seriously  deficient  in  their 
ability  to  translate  this  thinking  into  a 
process  that  galvanizes  the  people  in 
their  organization.  As  a  result,  we  see 
from  the  research,  for  example,  that 
only  5  percent  of  corporate  employees 
understand  their  company’s  strategy 
and  only  10  percent  of  strategic  initia¬ 
tives  are  successfully  executed. 

My  point  is  that  despite  some  excel¬ 
lent  work  on  understanding  future- 
state  CIO  competencies,  we  still  have 
a  long  way  to  go  before  we  truly 
understand  and  have  a  cadre  of  CIOs 
that  understand  business  strategy,  can 
think  strategically  and  can  translate 


this  thinking  into  successful  execu¬ 
tion  for  the  enterprise. 

PETERS.  DELISI 

President,  Organizational  Synergies 
Fremont,  Calif. 

Situational  Appraisal 

We  at  Kepner-Tregoe  read  the  article 
“Situational  Awareness  101”  by  John 
Baldoni  [ www.cio.com/article/1444SO ] 
with  great  interest  and  approval.  As  a 
global  management  consultancy  spe¬ 
cializing  in  the  systematic  application 
of  thinking  processes  to  resolve  com¬ 
plex  issues,  problems  and  decisions  in 
business  contexts,  we  feel  Mr.  Baldoni’s 
iteration  of  the  role  that  knowledge 
around  context,  circumstance  and  con¬ 
sequence  plays  in  creating  awareness 
around  a  critical  situation  is  compel¬ 
ling.  With  an  understanding  of  these 
factors,  a  leader  can  more  comprehen- 


sively  become  aware  of  the  situation. 

To  add  to  Mr.  Baldoni’s  discussion,  I 
would  like  to  refer  to  a  rational  think¬ 
ing  process  that  we  call  “situation 
appraisal.”  This  process  transfers  the 
“awareness”  into  “action”  that  the  leader 
will  have  confidence  in.  Very  simply 
explained,  this  process  is  one  of: 

■  Identifying  issues  in  a  complex 
situation  systematically 

■  Setting  priorities  based  on  fac¬ 
tors  related  to  current  impact,  poten¬ 
tial  impact  and  urgency 

■  Planning  and  setting  expecta¬ 
tions  for  responsibility 

■  Involving  a  decision  process,  a 
root  cause  process  or  a  risk  manage¬ 
ment  tool  for  a  complete  resolution  of 
the  situation 

For  five  decades,  this  systematic 
thinking  process  has  been  used  for 
various  types  of  business  situations 


ranging  from  assessing  a  customer’s 
issue  on  a  help  desk  to  playing  a  criti¬ 
cal  role  in  setting  organizational  strat¬ 
egy.  It  can  be  used  “rapidly”  when  fast 
response  is  needed  or  can  be  used 
expansively  with  large  amounts  of 
statistical  data.  The  benefits  of  using 
this  approach,  whether  individually 
or  in  groups,  are  a  comprehensive, 
clear  and  shared  understanding  of 
the  situation  at  hand,  priority  setting 
based  on  data  and  a  commitment  to 
the  actions  identified  to  resolve  the 
issue  completely. 

Thank  you  for  sharing  Mr.  Baldoni’s 


What  Do  You  Think? 


You  can  post  your  THOUGHTS,  COM¬ 
MENTS,  INSIGHTS  AND  OPINIONS  on 

CIO  stories  at  www.cio.com.  Your  posts 
may  be  edited  for  length  or  clarity. 

cio.com 


initiating  concepts.  From  those  begin¬ 
nings  meaningful  action  may  arise. 

CHRISTOPH  GOLDENSTERN 

Global  VP  Technology  Practice,  Partner 
Kepner-Tregoe  Inc. 

Successful  Skills  for  CIOs 

In  response  to  your  Web  story  “Soft 
Skills:  Listening  for  Better  Leader¬ 
ship”  [www.cio. com/article/134800], 
listening  is  truly  the  only  way  a  man¬ 
ager  can  gather  all  the  facts  needed. 
Group  intelligence  is  more  often  than 
not  greater  than  the  sum  of  its  individ¬ 
ual  pieces  (Wisdom  of  Crowds).  The 
manager  must  set  the  stage  by  being 
open  and  listening  to  his  or  her  staff. 
Unless  subordinates  feel  free  to  dis¬ 
cuss  issues,  the  CIO  will  only  be  given 
an  answer  that  ratifies  their  own  pre¬ 
conceived  notions. 

GARY  WOLLMAN 


You  have  to  stretch.  From  directing  your  company’s  IT  infrastructure  —  all  the  way  to 
contributing  to  its  business  goals.  You’re  the  one  pulled  between  two  worlds. 

Which  is  why  you’re  the  one  who  needs  Cognos.  We  are  the  experts  in  performance  management, 
delivering  a  single,  Web-based  SOA  platform  that  works  within  your  existing  infrastructure.  Unlike 
SAP  and  Oracle,  we  have  17  years  of  proven  performance  management  experience,  enabling 
organizations  like  yours  to  understand,  plan,  and  monitor  their  business.  And  with  over  23,000 
satisfied  customers  already,  we  can  put  success  within  your  reach. 


Proceed  with  confidence.'"  To  find  out  more,  visit  www.cognos.com/bungee  today. 
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THE  NEXT  LEVEL  OF  PERFORMANCE™ 


AMSUNG 

FlashSSD 


Samsung  Solid  State  Drive 


A  new-generation  Flash  drive  available 


in  notebooks  from  leading  OEMs. 


endurance  (MTBF1)  >  over  2  million  hours 


shock  resistance 

>  1500G  /  0.5ms 

read  speed 

>  100MB  /  sec 

write  speed 

>  80MB  /  Sec 

active  power  consumption  <  0.5W 

system  boot  speed2 

<  24  sec 

operating  temperature 

-25C  ~  85C 

L _ __ _ _ 

_ A 

’Mean  Time  between  Failure 

2HP  NX9420,  XP  Pro,  Core  Duo  Processor  2.0Ghz,  512MB  FIAM,  ICH  7,  i945  Chipset 
©  2007  Samsung.  All  rights  reserved. 


solid  state  reliability 

Introducing  the  new  Samsung  Flash  Solid  State  Drive  (SSD). 

No  moving  parts,  except  some  hardworking  electrons.  A  mean  time 
between  failures  (MTBF)  six  times  longer  than  a  hard  drive.  Virtually 
unlimited  shock  resistance.  And  power  use  that  extends  battery  life 
up  to  20%.  With  a  Samsung  SSD  inside  your  notebook,  your  data  is 
always  there  when  you  need  it. 

www.samsungssd.com 
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Gen  Y:  Too  Bigfor 
Its  Britches? 


HUMAN  RESOURCES  Call 
it  a  clash  of  cultures.  Generation 
Y  is  colliding  with  older  genera¬ 
tions,  and  the  differences  among 
baby  boomers  (those  born  between 
1946  and  1964),  Generation  X  (born 
between  1965  and  1981)  and  Gen¬ 
eration  Y  (born  after  1981)  in  com¬ 
munication  styles,  job  expectations 
and  cultural  frames  of  reference  are 
creating  tension  in  the  workplace. 

Gen  Y,  it  seems,  expects  a  con¬ 
stant  flow  of  promotions,  flexible 
schedules,  lots  of  vacation  time  and 
more  money— as  if  those  benefits 
were  its  right,  not  something  to  be 
earned.  But  because  Gen  Y  repre¬ 


sents  the  work¬ 
force  of  the  future, 
employers  are  changing 
their  HR  policies  in  response  to  its 
demands,  according  to  a  survey 
of  2,546  hiring  managers  and  HR 
professionals  conducted  by  Career 
Builder  and  Harris  Interactive. 

The  survey  results  reveal  major 
differences  in  the  way  Generation 
Y,  Generation  X  and  baby  boom 


employees  communicate. 

The  Gen  Y  frame  of  reference 
tends  to  be  influenced  by  blogs, 
Internet  sites,  and  the  like,  so  its 
communications  “tend  to  be  abbre¬ 
viated  and  at  times  abrupt,”  writes 
Rosemary  Continued  on  Page  18 
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A  Real,  Not  Virtual,  DataCenter  Problem 


staffing  IT  leaders  continue  to  battle  to  find 
virtualization  experts  and  other  technical  specialists  to 
staff  data  centers,  new  research  shows.  A  whopping  86 
percent  of  data  center  managers  said  they  struggle  to 
find  qualified  applicants  for  data  center  jobs,  according 
to  Symantec’s  latest  “State  of  the  Data  Center"  research 
report.  Furthermore,  52  percent  of  respondents  said 
that  their  data  centers  are  currently  understaffed. 

The  news  isn’t  great  for  the  people  toiling  in  those 
data  centers  right  now,  either:  Symantec’s  results  show 
that  these  employees  may  want  to  develop  an  emerging 
specialty  like,  say,  server  virtualization  or  storage  virtu¬ 
alization.  And  maybe  they  should  develop  those  skills 
sooner  rather  than  later.  Sixty  percent  of  data  managers 
called  their  staff’s  skill  sets  too  narrow.  And  more  than 
half,  57  percent,  said  their  employees’  skills  don’t  match 


their  current  data  center  needs. 

Looking  at  the  bigger  picture  for  data  centers,  69 
percent  of  respondents  to  the  Symantec  study  said  their 
data  centers  are  growing  at  least  5  percent  per  year;  11 
percent  said  they’re  growing  20  percent  or  more  per 
year.  During  the  past  two  years,  the  average  budget 
increase  was  7  percent. 

A  full  90  percent  of  respondents  said  they’re  at  least 
discussing  server  virtualization.  What  applications  are 
most  frequently  running  on  virtualized  environments? 
Fifty-nine  percent  of  respondents  said  Web  applications 
are  the  most  likely  to  run  in  a  virtual  environment;  42 
percent  said  database  management  applications. 

The  Symantec  study  queried  almost  900  data  center 
managers  worldwide,  in  Global  2000  companies  and 
large  public-sector  institutions.  -Laurianne  McLaughlin 
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Four  BI  Trends  Savvy 


business  intelligence  It’s  helped  restaurants 
decide  what  dishes  to  add  to  their  menus  and  it’s  helped  retailers 
determine  what  dresses  to  stock.  And  BI  is  growing.  A  Gartner 
study  found  it  to  be  this  year’s  number-one  technology  priority. 
Here  are  four  key  BI  trends  having  an  impact  today. 

i  Demand  Is  Rising.  “Organizations  are  recognizing  they 
don’t  have  the  information  they  need,”  says  Bill  Hostmann,  a 
Gartner  vice  president  and  distinguished  analyst.  Oh,  the  data  is 
there,  but  it’s  trapped  in  different  silos.  And  often,  definitions  of 
the  same  data  vary  from  silo  to  silo,  negatively  influencing  how 
and  which  numbers  are  reported. 

Q  The  Market  Is  Consolidating.  Independent  BI  companies 
may  soon  be  a  memory.  Oracle  bought  Hyperion  in  February. 

In  October,  SAP  made  a  bid  for  Business  Objects.  Last  month, 
IBM  announced  its  intention  to  acquire  Cognos.  Next  target? 
MicroStrategy.  As  big  vendors  acquire  smaller  ones,  it  will 
become  easierto  get  BI,  but  users  may  be  left  with  fewer  choices. 

Q|  Convergence  Is  Happening.  Unstructured  data  is  a  rich 
source  of  information  and  companies  are  looking  to  harness  it. 
For  example,  retailers  could  add  comments  from  e-mail  and  call 
centers  into  a  BI  application  to  enhance  their  market  analysis, 
says  Forrester  principal  analyst  Boris  Evelson. 

New  Apps  Are  a-Comin’.  The  next  generation  of  BI  applica¬ 
tions  is  moving  beyond  pie  charts  and  bar  graphs.  Products  like 
JMP  (from  SAS),  Spotfire  (from  Tibco)  and  others  provide  more 
creative— and  useful— visualization  of  data  and  trends.  Alterna¬ 
tive  ways  of  displaying  data  will  continue  to  proliferate  in  the 
coming  years.  (For  more  on  BI  in  action,  see  “BI  in  All  the  Right 
Places,”  Page  29.)  -Diann  Daniel 


No  Gold  Medal  for  Online  Ticketing 

i.t.  disaster  The  2008  Olympics  gave  up  on  onl  ine  ticket¬ 
ing  last  month  after  a  crush  of  buyers  crashed  the  system. 

The  Beijing  Organizing  Committee  for  the  Olympic  Games  will 
instead  offer  tickets  through  a  lottery  system,  with  ticket  applica¬ 
tions  accepted  from  Dec.  10  until  Dec.  30. 

The  system  crashed  shortly  after  sales  began  on  Oct.  30. 

During  the  first  hour  of  operation,  the  website  received  8  million 
page  views,  with  an  average  of  200,000  ticket  requests  filed  every 
minute.  Designed  to  handle  1  million  visits  per  hour  and  a  maxi¬ 
mum  of  150,000  ticket  requests  per  minute,  the  system  could  not 
cope.  -Sumner  Lemon,  IDG  News  Service 


TSenY 

Continued  from  Page  17 

Haefner,  CareerBuilder’s  VP  of  HR,  in 
an  e-mail.  Consequently,  the  tone  and 
meaning  of  those  truncated,  abbrevi¬ 
ated  messages  can  be  misunderstood  by 
boomers  and  Gen  X. 

Another  difference  between  Gen  Y 
and  older  workers  that  creates  tension 
is  Gen  Y’s  expectations  of  how  it  will  be 
treated  on  the  job.  A  whopping  87  per¬ 
cent  of  survey  respondents  said  some  or 
most  Generation  Y  workers  feel  more 
entitled  to  receive  better  compensation 
and  benefits  and  faster  career  advance¬ 
ment  than  older  workers  do. 

And  older  workers  aren’t  the  only 
ones  who  believe  that  Generation  Y 
acts  annoyingly  entitled.  Seventy-three 
percent  of  hiring  managers  and  HR 
professionals  age  25  to  29  also  said  Gen 
Y  workers  expect  more  money,  promo¬ 
tions,  flexible  work  schedules  and  vaca¬ 
tion  time. 

Gen  Y  has  been  so  vocal  about  what 
it  wants  that  employers  are  beginning  to 
take  notice.  Fifteen  percent  of  employers 
said  they  changed  their  HR  policies  or 
implemented  new  ones  to  cater  to  Gen¬ 
eration  Y  workers.  Among  the  changes 
they’ve  made: 

■  57  percent  introduced  more  flex¬ 
ible  work  schedules. 

■  33  percent  implemented  more  rec¬ 
ognition  programs. 

■  26  percent  give  employees  more 
access  to  state-of-the-art  technol¬ 
ogy- 

■  26  percent  increased  salaries  and 
bonuses. 

■  24  percent  offer  more  training. 

■  20  percent  pay  for  cell  phones  and 
BlackBerrys. 

■  18  percent  offer  more  telecommut¬ 
ing  options. 

■  11  percent  increased  vacation  time. 

Haefner  notes  that  “as  companies’ 

culture  evolves  with  each  generation, 
you’ll  see  all  workers  benefiting  from  a 
variety  of  viewpoints  and  work  styles.” 

We’ll  see.  -Meridith  Levinson 
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The  more  you  have  to  store, 
the  more  reliability  matters. 


Fujitsu  ETERNUS®  Storage  Systems:  Uncompromising 
reliability  for  your  most  demanding  applications. 


m 


To  help  enterprises  manage  the  flood  of  mission-critical  data,  Fujitsu  ETERNUS  Storage  Systems  deliver  the 
reliability  and  availability  data  centers  require.  For  continuous  data  access  and  easier  maintenance,  major 
components  are  redundant  and  hot-swappable.  The  controller  modules’  software  can  also  be  upgraded 
without  shutting  down  or  rebooting.  A  built-in  statistical  failover  mechanism  ensures  stable  operation  by  disabling 
components  exhibiting  intermittent  failures.  Furthermore,  disk  data  encryption  using  1 28-bit  AES  provides  security 
against  data  theft.  The  ETERNUS  Storage  Systems  range  from  the  new,  low-cost  ETERNUS  2000,  designed  for 
small  and  medium  businesses;  to  the  ETERNUS  8000  designed  for  large  enterprise  applications  and  is  available 
with  up  to  1 PB  of  storage.  Go  to  us.fujitsu.com/computers/reliablestorage  for  more  information. 


DATA  PROTECTION —Online,  efficient  disk-to-disk 
backup  using  tiered  storage 


FUJITSU 


DISASTER  RECOVERY -Cost-effective  WAN 
optimization,  secure  remote  data  replication  over 
iSCSI  with  IPsec  data  encryption 


THE  POSSIBILITIES  ARE  INFINITE 
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BY  KRISTIN  BURNHAM 


It’s  Not  About  Status; 
It’s  a  Phone,  Dammit 

Still  not  willing  to  pony  up 
the  cash  for  Apple’s  iPhone? 
Palm’s  wallet-friendly  alter¬ 
native— the  Centro  smart¬ 
phone-sells  for  a  mere  $99 
with  a  new  contract  from 
Sprint.  Centro  is  Palm's 
smallest  handheld— mea¬ 
suring  just  over  4  inches 
in  length  and  weighing  4 
ounces.  It  comes  equipped 
with  a  full  keyboard,  AIM 
and  text-messaging  capa¬ 
bilities,  and  speedy  Internet 
for  Web  searches.  $99. 
www.palm.com/us/ 
products/smartphones/ 
centra 


Looking  Good! 

Talkthetalkand  look  the  part 
in  these  sporty  shades.  Motorola 
and  Oakley  have  created 
0  ROKR  PRO  Bluetooth  Stereo 
Eyewear— sunglasses  that  con¬ 
nect  wirelessly  to  your  mobile 
phone  and  Bluetooth-enabled 
music  player.  These  specs 
promise  protection  from  harm¬ 
ful  rays,  and  up  to  100  hours  of 
standby  time.  $249. 
h  ttp://oakley.  com/ 
pd/5217/17805 


"Mr.  Flash  Drive,  I  Presume” 

Its  name  is  Key.  IronKey.  And  it’s  the  world’s  most 
secure  flash  drive.  Designed  so  you  can  safely  browse 
the  Web  and  transport  data,  this  James  Bond-worthy 
flash  drive  also  protects  against  phishing  and  pharming 
attacks,  ID  theft  and  keystroke  loggers.  Forgot  your  password?  You've  got  10 

consecutive  tries  before— yup,  you  guessed  it!— the 
device  (internally)  self-destructs,  wiping  its  drive 
clean  as  a  whistle.  $79-$149.  www.ironkey.com. 

If  more  glam  is  what  you  seek,  check  out 
Swarovski’s  crystal-encrusted  USB  Memory  Key. 
$178.  www.swarovski.com 


A  Sense  of  Where  You  Are 

Everybody  hates  traffic,  but  now  you  can  say 
goodbye  to  gridlock  thanks  to  The  Sharper 
Image’s  TomTom  ONE  3rd  Edition  GPS  Por¬ 
table  Navigation  System.  It  comes  with  real¬ 
time  traffic  and  weather  info  and  allows  you 
to  choose  your  route— the  shortest,  the  most 
scenic  or  the  toll-free.  The  wallet-size  device 
features  a  3.5-inch,  antiglare  touch  screen. 
$250.  www.sharperimage.com/us/en/ 
catalog/product/sku _ TT115 
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It’s  the  ability  to  have  Microsoft®  Windows  Server®  and  SUSE®  Linux  Enterprise 
Server  from  Novell®  work  together.  And  the  ability  to  run  both  with  more  confidence 
It’s  Microsoft  and  Novell  working  together  to  reduce  costs  and  complexity  with  new 
solutions  for  virtualization,  directory  integration,  systems  management,  and  office  document 
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COLLABORATION 

ROADMAP 


NOW  Ml 
OPERATING  SYSTEMS  CAN  TOO 


frit  'M 


ABILITY 


translators — each  with  clearly  defined  intellectual  property  rights.  So  you  can  take  compromise  out  of 


the  data  center  and  put  simplicity  and  efficiency  in. 


Download  the  collaboration  roadmap  at  VAfWW.moreinterop.com 


Novell,  Microsoft 

Copyright  ©  2007  Novell.  Inc  and  Microsoft  Corporation  All  Rights  Reserved.  Novell,  the  Novell  logo  and  SUSE  are  registered  trademarks  of  Novell,  Inc.  in  the  United  States  and  other 
countries.  Linux  is  a  registered  trademark  of  LmuS  Torvalds.  Microsoft  and  Windows  Server  are  trademarks  of  the  Microsoft  group  of  companies. 
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Will  You  Be  Lucky  in  Lucknow? 


outsourcing  Bhubaneswar.  Lucknow. Gandhi¬ 
nagar.  Ahmedabad.  These  are  just  a  few  of  the  new  hot 
spots  for  outsourcing  shops  in  India.  Never  heard  them? 
Don't  feel  too  bad.  Yet. 

A  recent  article  in  India’s  Economic  Times  says  the 
country’s  tier  1  outsourcing  providers  are  increasingly 
looking  to  tier  2  and  even  tier  3  towns  to  set  up  their  lat¬ 
est  campuses,  as  real  estate  and  the  cost  of  living  have 
skyrocketed  in  the  bigger  cities  that  served  as  the  unof¬ 
ficial  headquarters  of  India’s  IT  services  boom. 

In  other  words,  Bangalore  is  out.  Kochi  is  in. 

While  attracting  entry-level  employees  to  jobs  in 
the  tier  2  municipalities  hasn’t  been  terribly  difficult, 
management  talent  has  proven  harder  to  attract. 

Middle  managers  are  more  concerned  about  issues 
like  schools,  health  care  and  quality  of  life  than  their 
younger  counterparts,  and  some  workers  have  career 
concerns,  wondering  if  a  move  to  a  second-tier  location 
is  more  a  detour  than  a  move  up  the  ladder. 

“Most  tier  2  centers  are  currently  bottom-heavy,  and 
the  complexity  of  work  is  not  that  high,”  Pari  Natarajan, 


CEO  of  outsourcing  research  firm  Zinnov,  tells  the  Eco¬ 
nomic  Times. 

Outside  of  India,  in  less  mature  markets  like  Latin 
America,  IT  services  providers  are  jumping  to  second- 
tier  cities  from  the  get-go.  "You  can  take  some  of  the 
best  practices  from  India  and  look  at  second-tier  cities 
to  set  up  a  large  center,”  says  Juan  F.  Ferrara,  chief  oper¬ 
ating  officer  for  the  Americas  for  India-based  IT  service 
provider  Genpact.  "You’re  already  seeingthat  in  Brazil 
and  Argentina.” 

So  what  happens  when  India’s  tier  2  (or  even  tier  3) 
cities  grow  as  expensive  as  their  more  mature  counter¬ 
parts?  Will  offshore  service  providers  or  their  customers 
consider  locating  the  work  in  the  U.S.?  Don’t  bet  on  it. 
There  were  several  media  reports  this  year  of  a  few  Sili¬ 
con  Valley  companies  bringing  jobs  back  from  Banga¬ 
lore  in  response  to  rising  wages  and  retention  problems. 
But  such  cases  will  probably  remain  the  exception,  not 
the  rule. 

Tier  4,  anyone? 

-Stephanie  Overby 


No  Consultants  Need  Apply 


on  the  move  Land¬ 
ing  a  CIO  job  has  never 
been  easy  for  consultants. 

Companies,  especially  big 
ones,  tend  to  shy  away  from 
candidates  with  consulting 
backgrounds,  worrying  that 
they  lack  the  tact,  political 
savvy,  and  ability  to  operate 
with  an  existing  IT  staff  and  within  a 
limited  budget  necessary  to  be  suc¬ 
cessful,  says  Steve  Kendrick,  an  execu¬ 
tive  recruiter  with  Spencer  Stuart’s 
global  information  officers  practice. 

So  if  you’re  a  consultant,  your  best 
bet  is  to  market  yourself  to  small  and 
midsize  companies.  Smaller  compa¬ 
nies  with  growth  goals  often  seek  to 


leverage  your  experience 
working  in  different  indus¬ 
tries  or  with  other  compa¬ 
nies  in  the  same  industry. 

A  number  of  consultants 
have  recently  bucked  the 
trend  and  landed  CIO  jobs: 

Brian  O’Connell  proved 
his  mettle  to  The  Hartford 
Financial  Services  Group  after  work¬ 
ing  on  a  project  for  the  company  while 
employed  by  Accenture.  He  was  hired 
as  CIO  of  Hartford  Life  in  October. 

Jeremy  Gill  had  been  advising  $651 
million  engineering  firm  Michael  Baker 
on  its  information  security  practices 
when  it  hired  him  as  its  vice  president 
of  IT,  also  in  October. 


Roger  Johnsen  provided  executive 
IT  consulting  services  to  iTerra  Com¬ 
munications  and  Google  before  being 
hired  as  $10.8  million  Intraware’s  vice 
president  of  IT  in  September. 

Steve  Dewsnap  had  been  working 
for  Mace  Security  International  as  an 
independent  consultant  for  five  years 
before  the  $49  million  defense  prod¬ 
ucts  company  hired  him  in  September. 

Tim  Kutz  worked  in  Accenture’s 
global  forest  products  practice  before 
joining  privately  held  paper  and  pack¬ 
aging  distributor  Unisource  Worldwide 
in  August. 

So,  consultants,  don’t  despair. 
There’s  prejudice  out  there,  but  you 
can  beat  it.  -Meridith  Levinson 


Brian  O'Connell 


cio.com 


|  Read  Meridith  Levinson’s  MOVERS  AND  SHAKERS  blog  for  the  latest  moves.  Find  it  at  blogs.cio.com. 
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motorola,  c  om / 1 0Qkswifches 


Depend  on  the  market  share  leader  for  all  your  wireless  LAN  needs. 
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hot  jobs 


For  more  HOT  JOBS  go  to 

www.cio.com/article/101314 


BY  FRED  O'CONNOR 


Head  of  IT  HR 


job  description:  The  head  of  IT  HR  handles  the  recruiting, 
screening  and  interviewing  of  job  candidates  for  an  IT  depart¬ 
ment.  Executives  in  this  position  need  to  report  to  the  CIO  while 
maintaining  a  relationship  with  human  resources,  says  Andy 
Zaleta,  partner  and  coleader  of  the  technology  practice  in  the 
Americas  for  executive  search  firm  Battalia  Winston  Interna¬ 
tional.  Although  this  job  requires  a  presence  in  both  depart¬ 
ments,  heads  of  IT  HR  are  “doomed  to  fail”  if  they  straddle  the 
line  between  IT  and  HR,  says  Zaleta.  This  person  is  ultimately 
responsible  for  handling  IT’s  staffing  needs  and  should  main¬ 
tain  a  focus  in  that  realm,  he  says.  Large  companies  that  value 
employees  who  truly  understand  a  firm’s  technology  often  hire 
for  this  position. 

nmiiimiimmimmmmmimmimmmmmmmimmimimmimi! 


why  you  need 
one:  Companies  have 
become  specialized  in 
the  types  of  technology 
they  use  and  develop, 
says  Zaleta.  This  spe¬ 
cialization  often  requires 
new  hires  who  can  use  or 
support  an  organization’s 
key  applications  and  IT 
systems.  Traditional  HR 
personnel  may  not  rec- 


$75,000  to 
$150,000 

plus  bonus, 
depending 
on  level 


ognize  that  a  candidate’s 
experience  with  a  tech¬ 
nology  may  not  translate 
to  their  own  organization, 
which  may  use  different 
products.  For  instance,  a 
candidate’s  past  familiar¬ 
ity  with  SAP’s  business- 
intelligence  software  may 
not  be  relevant  at  a  com¬ 
pany  that  uses  Oracle  Bl 
products. 

desired  skills: 

Strong  knowledge  of  IT. 
Undergraduate  degree 
with  technology  or  HR 
focus  is  a  must.  A  head 
of  IT  HR  is  “not  going  to 
write  code,  but  knows 
what  makes  someone 
successful  in  that  func¬ 
tion,”  says  Zaleta.  Good 
sales  and  communica¬ 


tion  skills  are  also  key  to 
help  sell  candidates  on  a 
company  and  its  jobs. 

how  to  find  them: 

This  is  a  burgeoning 
position,  according  to 
Zaleta,  so  finding  a  quali¬ 
fied  candidate  may  prove 
challenging.  Try  regional 
IT  professional  orga¬ 
nizations  since  people 
in  certain  fields  tend  to 
cluster  geographically. 
For  example,  IT  workers 
with  financial  services  or 
retail  experience  tend  to 
congregate  in  New  York. 
Look  also  for  candidates 
with  less  formal  titles 
such  as  director  of  talent 
or  head  of  talent  acquisi¬ 
tions,  especially  at  tech¬ 
nology  companies. 


what  to  look  for: 

Candidates  must  blend 
methodical,  detail-ori¬ 
ented  traits  with  innova¬ 
tive  and  creative  skills. 

A  person  who  is  a  total 
techie  may  lack  the 
social  skills  that  recruit¬ 
ing  demands.  However,  a 
smooth  personality  with¬ 
out  an  IT  background 
isn’t  the  right  match 
either,  Zaleta  says.  A 
person  in  this  job  must 
also  be  comfortable  with 
transitioning  between 
two  distinct  roles. 

elimination 
round:  Ask  a  can¬ 
didate  how  she  would 
handle  a  job  that  needs 
to  be  sensitive  to  corpo¬ 
rate  politics.  People  who 
don’t  realize  that  they 
need  to  maintain  equa¬ 
nimity  and  stay  above  the 
fray  won’t  work  out  well. 


growing 
own: 


aw 


Look  for 
technologists  on  staff 
who  understand  the 
company’s  IT  structure 
but  who  also  have  an 
outgoing  personality 
that  lends  itself  to  sales 
and  marketing.  They’ll 
need  to  learn  about 
human  resources,  but 
those  skills  are  easier  to 
teach  than  IT. 
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•  Current  research  results 

•  Case  studies 

•  Best  practices 


The  vulnerability  of  your  business 


is  connected  to  the  enormity  of  your  IT  infrastructure 


is  connected  to  an  accurate  assessment  of  the  risks  involved 


is  connected  to  solutions  that  manage  security,  availability,  and  compliance 


is  connected  to  Symantec  Global  Services  for  results  that  shine 


from  assembly  line  to  the  bottom  line 


iyrmintec  Logtrare  registered  trademai 


Manage  IT  risk  and  cost  across  your  entire  operation  with  the  unmatched  expertise  of  Symantec. 

The  first  step  in  dealing  with  IT  risk  is  to  quantify  it  precisely.  Our  expert  assessments  quickly  give  you  the  necessary 
input  to  select  the  appropriate  solution  to  fit  your  needs  and  budget.  And  once  IT  risk  is  mitigated,  the  cost  advantages 
throughout  your  enterprise  can  be  dramatic.  Realize  the  potential  in  your  operation  with  the  help  of  the  Global  Services 
team  from  Symantec.  To  contact  a  representative  call  1-877-870-5700  or  visit  symantec.com/confidence 


^  Symantec. 


Confidence  in  a  connected  world. 
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IT  Risk 
Management 


Rising  to  the  Top  of  CIO  Agendas 

Security  challenges  need  to  be  tackled  within 
a  broader  understanding  of  IT  risks. 


In  CIO  Magazine’s  2007  “State  of  the  CIO” 

annual  survey,  respondents  were  asked  for  the  first  time 
about  IT’s  role  in  risk  management.  A  third  of  the  respon¬ 
dents  reported  that  IT  was  actively  improving  IT  risk  man¬ 
agement.  Asked  where  IT  had  a  positive  impact  on  busi¬ 
ness  in  the  past  year,  respondents  put  “improved  security 
risk  management”  in  the  top  five  of  IT  accomplishments. 
And  among  IT  management  priorities  for  the  year  ahead, 
business  continuity  risk  management  was  ranked  third 
among  all  priorities. 


These  findings  align  with  other  IT 
indices  and  demonstrate  how  IT  risk 
management  is  now  a  significant  priority 
on  CIO  agendas. 

Symantec’s  Vision  for  Managing  IT  Risk 

As  businesses  increasingly  depend  on 
IT  to  automate  processes  and  manage  in¬ 
formation,  IT  risk  has  become  one  of  the 
most  significant  drivers  of  business  risk 
that  organizations  face.  A  quick  scan  of 
recent  headlines  reveals  how  IT  failures 
have  become  synonymous  with  business 
failures  in  many  organizations. 

A  variety  of  factors  are  fueling  IT 


threat  landscape  and  a  proliferation 
of  compliance  regulations  are  two  ex¬ 
amples.  A  third  is  growing  complex¬ 
ity  in  IT  operations  caused  by  global 
expansion,  the  proliferation  of  heterog¬ 
enous  systems,  mergers,  acquisitions, 
growing  data  volumes  and  more. 

IT  risk  includes  security,  availability, 
performance  and  compliance  elements, 
each  with  its  own  drivers  and  capacity 
for  harm.  A  successful  strategy  for  man¬ 
aging  IT  risk  can  reduce  risk  exposure  in 
each  of  these  areas,  but  it  can  do  much 
more.  For  example,  to  drive  out  risk,  or¬ 
ganizations  must  embrace  best  practices 


risk.  Rapid  changes  in  the  security 

for  governance,  reporting  and  change 
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The  key  is  taking  a  holistic  approach  and  aiming 
for  simplicity. 


management,  which  also  reduce  IT 
complexity  and  bring  new  levels  of 
efficiency. 

Developing  a  deeper  understand¬ 
ing  of  IT  risks  can  also  create  greater 
capacity  for  innovation.  In  recent  de¬ 
cades,  IT  innovations  have  opened 
new  markets,  established  new  busi¬ 
ness  models  and  driven  incredible 
gains  in  productivity.  None  of  this 
would  have  been  achieved,  however, 
if  IT  teams  didn’t  have  the  confidence 
to  embrace  new  technologies  or  com¬ 
bine  existing  technologies  in  new  and 
innovative  ways.  As  the  impact  of  IT 
failures  on  business  results  becomes 
more  pronounced,  organizations  that 
understand  IT  risk  are  in  the  best 
position  to  continue  using  IT  to  drive 
competitive  advantage. 

Consider  the  ING  Renault  FI 
Team  in  Oxfordshire,  England. 
They  rely  on  large  volumes  of  real¬ 
time  data  from  races  around  the 
world  to  make  rapid  changes  to  car 
surfaces — all  to  shave  fractions  of  a 
second  off  of  race  times.  The  ING 


Renault  FI  Team  uses  a  combination 
of  Symantec  products  and  services  to 
manage  availability  and  backup  data. 
These  protection  measures  help  them 
achieve  success  with  a  competitive 
strategy  that  depends  on  IT. 

IT  risk  management  also  provides 
a  common  language  that  IT  can  use 


to  drive  alignment  with  the  busi¬ 
ness.  Historically,  IT  used  technical, 
domain-specific  language  in  its 
side  of  the  dialogue,  recasting 
business  issues  in  terms  of  SLAs,  re¬ 
covery-time  and  recovery-point  ob¬ 
jectives,  incidents  and  response  time. 
The  most  successful  new-infrastruc- 
ture  strategists  now  ask: 

•  Which  business  processes 
contribute  most  to  corporate  com¬ 
petitiveness — that  is,  which  are  the 
most  distinctive  compared  to  com¬ 
petitors? 

•  Which  processes,  if  shocked 
or  interrupted,  could  most  severely 
jeopardize  the  health  of  the  business? 

•  To  which  technology  risks  are 
these  critical  processes  most  exposed: 
security,  availability,  performance  or 


compliance? 

•  How  should  we  allocate  infra¬ 
structure  investments — in  people, 
processes,  technology  and  informa¬ 
tion — for  the  best  overall  balance  of 
risk  and  cost? 

By  aligning  IT  with  business 
needs,  organizations  can  avoid  costly 


over-investment  or  risky  under¬ 
investment  in  technologies  and 
processes  that  protect  the  business 
from  harm.  IT  risk  and  cost  can  be 
balanced  for  optimal  returns. 

Understanding  IT  Risk 

In  Symantec’s  view,  IT  risks  may 
be  classified  in  four  ways: 

•  Security  risks — unauthorized 
access,  alteration  or  use  of  information 

•  Availability  risks — inaccessible- 
business  processes  or  data 

•  Performance  risks — delayed 
access  to  business  processes  or  data 

•  Compliance  risks — violating 
legal,  regulatory  or  IT  policy 
requirements. 

To  address  growing  interdepen¬ 
dencies,  it  is  important  to  look  at 
risk  across  these  areas  holistically. 
Many  organizations  are  starting  to 
create  positions  with  titles  such  as 
managing  director  of  IT  risk  for 
this  very  purpose. 

Symantec  recently  conducted  a 
yearlong  study  based  on  in-depth, 
structured  interviews  with  more 
than  500  IT  professionals  around 
the  world,  and  published  the  re¬ 
sults  as  the  IT  Risk  Management 
Report:  Trends  Through  December 
2006.  The  study  revealed  many 
surprising  insights  into  current 


Organizations  that  understand  IT  risk  are  in 
the  best  position  to  continue  using  IT  to  drive 
competitive  advantage. 
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practices  and  perceptions  of  IT 
risk  exposure. 

For  one  thing,  expectations  of 
failure  are  disturbingly  high.  A  full 
60  percent  of  organizations  expect 
a  major  IT  incident  at  least  once 
per  year.  Fifty-eight  percent  expect 
a  major  data  loss  at  least  once  ev¬ 
ery  five  years.  Whereas  many  other 
parts  of  business  operations  aspire 
to  zero  defects  or  zero  accidents, 
most  IT  organizations  have  yet  to 
set  a  target  of  zero  IT  failures. 

The  study  further  identi¬ 
fied  substantial  differences  in 
the  estimates  of  IT  risk  exposure 
supplied  by  IT  operational  per¬ 
sonnel  and  executives.  In  fact, 
differing  internal  viewpoints  on  IT 
risk  and  poor  alignment  between 
IT  risk  management  programs  and 
overall  business  objectives  may 
themselves  create  risk.  This  can 
occur  when  risk  management  pro¬ 
grams  are  not  tailored  to  the  specific 
risk  profile  of  the  business  or  coordi¬ 
nated  across  functional  and  business 
unit  lines — leading  to  areas  of  both 
under-  and  over-investment. 

Furthermore,  poor  organiza¬ 
tional  support  for  IT  risk  aware¬ 
ness  and  training  is  both  an  exam¬ 
ple  of  poor  alignment  and  a  major 
cause  of  IT  risk  exposure.  In  fact, 
best-in-class  IT  risk  management 
requires  a  disciplined  approach 
that  includes  everything  from  IT 
risk  awareness  to  the  creation  of  a 
sustained  IT  risk  management  pro¬ 
gram,  complete  with  performance 
measurement  and  a  model  for  con¬ 
tinuous  improvement. 


IT  Risk  Management: 

Where  to  Get  Started 

Many  organizations  lack  the  prop¬ 
er  skills  and  resources  to  assess  and 
address  IT  risk  through  a  systematic 
approach  that  aligns  IT  with  business 
priorities.  Symantec  Foundation  IT 
Risk  Assessment  helps  customers  take 
the  first  step  toward  a  comprehensive 
IT  risk  management  program. 

Kenton  ffoover,  Senior  Man¬ 
ager  for  solutions  within  Symantec 
Global  Services,  recommends  follow¬ 
ing  the  five-step  approach  used  by 
Symantec: 

•  Develop  an  awareness  and 
understanding  of  specific  IT  risks  to 
your  business — security,  availability, 
performance  and  compliance. 

•  Quantify  risk  exposure  as  much 
as  possible  and  prioritize  risk  areas  for 
remediation. 

•  Understand  the  range  of  tools 
available  for  managing  IT  risk  and 
design  a  solution. 

•  Align  IT  risks  and  costs  with 
the  business  to  find  the  right  level 
of  investment  and  implement  the 
solution. 

•  Develop  a  systematic  ongoing 
capacity  to  manage  IT  risk. 

The  key  is  taking  a  holistic 
approach  and  aiming  for  simplicity. 
None  of  these  steps  or  concepts  has 
value  if  they  only  add  complexity. 
“In  some  cases,  we  see  IT  organiza¬ 
tions  undergoing  a  risk  management 
effort  just  to  get  through  an  audit, 
or  because  there  has  been  some  kind 
of  incident  and  everyone’s  hair  is  on 
fire,”  says  Jennie  Grimes,  director 
of  Symantec’s  IT  Risk  Management 


Focusing  on  Risk 
and  Security  at 
Kettering  Medical 
Center  Network 

Kettering  Medical  Center 
Network  (KMCN),  a  group  of 
five  hospitals  and  51  medical 
facilities  in  the  Dayton,  Ohio, 
area,  is  at  the  forefront  of 
efforts  to  improve  the  quality 
of  healthcare. 

For  Bob  Burritt,  manager  of 
network  and  technology  services 
at  KMCN,  and  his  team  of  33  IT 
professionals,  the  main  focus  is 
keeping  the  5,000  connected 
devices  of  KMCN’s  network  up 
and  running  to  support  7,500 
staff  professionals  in  their  mis¬ 
sion  of  healing.  "Nobody  under¬ 
stands  the  value  of  prevention 
like  a  hospital,”  says  Burritt. 

“We  put  a  premium  on  spotting 
and  stopping  small  problems 
before  they  become  big  ones. 

"If  our  network  is  down  be¬ 
cause  of  a  security  incident,  or 
for  any  other  reason,  we  calcu¬ 
late  that  our  organization  would 
lose  a  million  dollars  of  revenue 
a  day,”  says  Burritt.  From  a 
field  of  23  security  vendors  who 
responded  to  their  enterprise 
security  assessment  RFQ,  they 
eventually  narrowed  the  field 
to  three— and  then  ultimately 
selected  Symantec  Consulting 
Services.  “Symantec  showed 
us  it  not  only  had  the  capability 
to  conduct  our  security  assess¬ 
ment,”  Burritt  recalls, “it  also 
gave  us  the  big  picture  of  what 
our  secure  environment  should 
look  like— and  did  so  more 
effectively  than  any  other 
vendor.” 
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Lessons  Learned 
at  Temple 
University 


On  the  first  day  of  each  fall 
term  at  Temple  University  in 
Philadelphia,  thousands  of  young 
men  and  women  arrive  loaded  with 
clothes,  books,  posters,  sports 
equipment— and  laptop  computers, 
many  of  which  are  carrying  their 
own  baggage  in  the  form  of  viruses, 
worms,  Trojans,  spyware  and  ad¬ 
ware.  With  more  than  14,000  users 
connected  to  its  network,  including 
its  annual  crop  of  students,  Temple 
was  plagued  with  crippling  attacks 
and  illegal  file  sharing.  After  taking 
a  piecemeal  approach  to  solving 
these  problems,  the  Temple  IT  team 
was  ready  to  look  for  more  holistic 
solutions. 

In  response,  Symantec  Consult¬ 
ing  Services  performed  a  security 
analysis,  recommended  best  prac¬ 
tices,  designed  policy,  implemented 
the  required  infrastructure  and 
deployed  the  Symantec  Network 
Access  Control  (SNAC)  solution. 
“The  team  supported  us  all  the 
way  from  installation  through 
deployment  and  beyond,"  says 
Seth  Shestack,  Assoc  Director 
of  Information  Security. 

"Now  when  a  student  tries  to 
connect  to  the  network,  Symantec 
Sygate  Enterprise  Protection  per¬ 
forms  a  series  of  checks,”  Shestack 
explains.  "It  looks  for  the  SNAC 
agent  and  Symantec  Endpoint 
Protection.  Threat  definition  files 
and  patches  must  be  up  to  date, 
and  Windows  Automatic  Update 
must  be  enabled.  Sygate  ensures 
a  base  level  of  protection  for  every 
machine  on  the  network,  every  time 
it  connects." 
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Program  Office.  “That’s  under¬ 
standable  and  human,”  she  says. 
“But  the  idea  of  adopting  a  five-step 
approach  is  healthier  for  organiza¬ 
tions  than  simply  committing  ran¬ 
dom  acts  of  IT  risk  management.” 

Putting  Security  Risk  in  Perspective 

The  past  few  decades  have  seen 
tremendous  change  as  evolutions 
in  communication  have  made  new 
forms  of  interaction  possible.  We 
are  more  connected  to  each  other 
than  ever — and  in  more  ways  than 
ever.  Expectations  have  grown  to 
the  point  where  most  business 
workers  expect  to  access  informa¬ 
tion  and  conduct  business  when¬ 
ever  and  wherever  they  desire.  To 
satisfy  expectations  and  create  the 
confidence  that  will  drive  the  next 
generation  of  innovation,  IT  se¬ 
curity  experts  must  protect  an  ex¬ 
panding  array  of  connection  points 
and  communication  channels. 

Take  mobile  communications, 
for  example.  Almost  one  in  five 
businesses  has  already  experienced 
financial  loss  due  to  attacks  via  mo¬ 
bile  data  platforms,  according  to 
a  global  survey  by  the  Economist 
Intelligence  Unit.  More  than  60 
percent  of  companies  are  holding 
back  on  deployment,  citing  security 
concerns.  In  fact,  security  concerns 
are  the  biggest  obstacle  to  the  wide¬ 
spread  adoption  of  wireless  and 
remote  computing  in  businesses 
worldwide  today. 

When  it  comes  to  security  risks, 
Symantec  has  established  some  of 
the  most  comprehensive  sources  of 


security  threat  data  in  the  world. 
For  instance,  the  Symantec  Global 
Intelligence  Network,  consisting  of 
more  than  40,000  sensors  monitor¬ 
ing  network  activity  in  over  180 
countries,  tracks  attack  activity 
across  the  entire  Internet.  Data  is 
used  to  drive  the  Symantec  Internet 
Security  Threat  Report  as  well  as 
key  Symantec  offerings  like  Syman¬ 
tec  Managed  Security  Services. 

The  version  of  the  Symantec 
Internet  Security  Threat  Report 
published  in  September  cov¬ 
ers  data  collected  from  January 
through  June  2007  and  offers 
some  ominous  conclusions.  In 
particular,  the  report  states  that 
today’s  threat  landscape  is  more 
dynamic  than  ever.  As  security 
measures  are  developed  and  im¬ 
plemented,  attackers  are  rapidly 
adopting  new  techniques  and  strate¬ 
gies  to  circumvent  them.  Attacks  are 
more  likely  than  ever  to  be  targeted, 
delivered  through  a  combination  of 
vehicles,  and  even  crafted  by 
tools  that  are  created  through  a 
standard  software  development 
life  cycle. 
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The  Importance  of 
an  Endpoint  Protection 
Strategy 

When  addressing  end¬ 
point  protection— security 
at  the  desktop  and  laptop 
levels— it’s  critical  to  have 
technology  that  can  solve  the 
clutter  of  competing,  some¬ 
times  incompatible  applica¬ 
tions  that  actually  end  up 
increasing  vulnerability.  One 
key  is  to  implement  solutions 
that  deliver  advanced  threat 
prevention  in  a  single  agent. 
This  single-agent  approach  is 
critical  to  the  manageability 
of  security  and  to  stopping 
threats  where  they  originate. 

Properly  conceived  and 
executed,  endpoint  protection 
reduces  the  administrative 
costs  associated  with  manag¬ 
ing  multiple  endpoint  security 
products  by  bringing  together 
the  best  available  technology. 
This  provides  operational  effi¬ 
ciencies  and  a  fully  integrated 
solution  that  can  work  across 
platforms. 

Similarly,  by  integrating 
network  access  control  and 
security  into  a  single  endpoint 
agent,  Symantec  enables 
customers  to  more  quickly 
and  easily  deploy  Symantec 
Network  Access  Control,  and 
provides  significant  operation¬ 
al  efficiencies  such  as  single 
software  and  policy  updates, 
unified  reporting,  and  unified 
licensing  and  maintenance. 
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To  address  the  evolving  threat 
landscape,  organizations  need  a  com¬ 
prehensive  approach  to  security  that 
includes  the  following: 

•  Definition  of  security  policies 
that  comply  with  regulations  and 
align  with  business  priorities 

•  Technology  for  endpoint  pro¬ 
tection  across  laptops,  desktops,  serv¬ 
ers  and  mobile  devices 

•  Technology  for  managing  email 
security  and  database  security  while 
preventing  data  loss 

•  Tools  for  security  management 
that  handle  event  logs,  distribute 
patches  and  track  configurations 

•  Operational  best  practices  for 
threat  management,  incident  re¬ 
sponse  and  secure  application  devel¬ 
opment. 

•  Optimized  organizational  design 
that  leverages  Managed  Security  Ser¬ 
vices  Providers  and/or  augments  staff 
with  third-party  experts  as  needed 


•  A  reporting  infrastructure  that 
provides  customized  dashboards  to  ex¬ 
ecutives  responsible  for  governance. 

Taking  the  First  Step 

Symantec  offers  solutions  com¬ 
prised  of  products  and  services  that 
reduce  exposure  to  security  risk  and 
address  each  of  the  points  outlined 
above.  Comparable  solutions  are 
available  to  help  customers  address 
IT  risks  related  to  availability,  com¬ 
pliance  and  performance.  If  you’re 
unsure  which  areas  of  IT  risk  are 
the  highest  priority  for  you  to  ad¬ 
dress  first,  Symantec  Foundation 
IT  Risk  Assessment  is  an  excellent 
place  to  start. 


FOR  MORE  INFORMATION  about 
Symantec  Foundation  IT  Risk 
Assessment  please  visit 

www.symantec.com/itrisk. 


The  Increasingly  Ominous 
Security  Environment 

In  its  worldwide  surveillance  of  security  threats,  Symantec 
has  observed  that  the  current  threat  landscape  is  characterized 
by  new  and  worrisome  characteristics,  including: 

•  Increased  professionalization  and  commercialization 
of  malicious  activities 

•  Threats  that  are  increasingly  tailored  for  specific 
regions 

•  Increasing  numbers  of  multistage  attacks 

•  Attackers  targeting  victims  by  first  exploiting  trusted 
entities  (such  as  employees  or  partners) 

•  Convergence  of  attack  methods. 
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The  supplier  is  connected  to  the  regional  buyer 
is  connected  to  the  channel  partner 
is  connected  to  the  supply  chain  management  system 
is  connected  to  the  malicious  code  which  was  just  eradicated  by 

the  world’s  leading  enterprise  security  company. 


Enterprise  security  software  that  gets  to  threats  before  they  get  to  you.  Crimeware.  Malicious  users. 
Data  leakage.  The  threat  landscape  is  constantly  changing.  Symantec  can  provide  you  with  global,  24/7  protection  to 
safeguard  every  layer  of  your  enterprise -from  your  mobile  devices  to  your  data  center.  Our  Global  Intelligence  Services 
proactively  monitor  emerging  threats  to  make  sure  your  business  is  always  protected.  Visit  symantec.com/confidence 


Confidence  in  a  connected  world. 


Symantec 


CALL  FOR  ENTRIES 


IT  Makes  Winners. 


You  can’t  beat  the  competition  by  standing  still. 

And  you  can't  move  ahead  without  the  edge 
technology  provides. 

We  want  to  know  how  IT  makes  your 

company  grow. 

We’recelebratingall  the  innovative  ways  that  IT  can  deliver  a 
competitive  advantage  to  the  enterprise.  Perhaps  you  took  a  risk 
on  an  emergingtechnology  or  deployed  the  tried  and  true  in  a 
new  way.  Maybe  you  built  a  better  business  process  or  fostered 
closer  collaboration.  Or  you  found  ways  to  get  closer  to  existing 
customers,  to  pursue  new  markets,  to  save  money,  to  make  more. 

If  you  can  show  measurable  results  of  technology  innovationsthat 
have  enabled  or  led  the  way  to  greater  success  for  your  organization, 
then  our  readers— your  peers— want  to  know  about  you. 

Be  recognized  as  one  of  the  CIO  100. 

Apply  nowforthe 21st  Annual  CIO  100  Awards. 


CIO  100  honorees  will  be 
recognized  at  the  annual 
CIO  100  Symposium  &  Awards 
Ceremony,  Aug.  24-26,  2008, 
at  The  Broadmoor  in  Colorado 
Springs,  Colo.  Honorees— 
and  their  winning  ideas— will 
also  be  featured  online  and  in 
the  Aug.  15,  2008,  issue  of  CIO 


To  learn  more  about  the  CIO  100 
Awards  and  get  an  application, 

go  to  www.cio.com/cio-awards/ 
ciolOO/index 
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BUSINESS  TECHNOLOGY  LEADERSHIP 
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Xerox  Global  Services  helps  organization 
Result?  Service  levels  up.  Processing  cost 


Where  are  mission-critical  documents  when  you  need 
them?  In  a  file  cabinet?  A  computer?  Our  professional  and 
document  outsourcing  services  digitize  and  manage  critical 


business  processes,  taking  paper  and  manual  steps  oi 
The  results  are  a  dramatic  reduction  in  processing  cost 
a  significant  improvement  in  workflow,  and  a  distin 


xerox.com/retrieve  1-800-ASK-XEROX 


©  2007  XEROX  CORPORATION.  All  rights  reserved.  Xerox*  and  There's  a  new  way  to  look  at  it*  are  trademarks  of  XEROX  CORPORATION  in  the  United  States  and/or  other  countries. 


!)  find,  modify  and  manage  documents  instantly, 
itdown.  There’s  a  new  way  to  look  at  it. 


•ompetitive  edge  that  comes  from  working  faster  and 
,  nore  efficiently  than  your  competition.  Who  do  we  retrieve 
|  or?  JPMorgan  Chase  &  Co.  and  Enterprise  Rent-A-Car 


Company.  We  can  do  the  same  for  you.  To  see  how  we 
handle  everything  from  accounting  and  contracts  to 
HR  and  legal,  visit  us  today  at  xerox.com/retrieve. 


XEROX 


Technology 


Document  Management 


Consulting  Services 


Video  games  are  selling  ad  space;  production  studios  are 
releasing  content  via  broadband  providers;  P2P  networks  are 
disrupting  top-down  distribution.  Across  the  board,  technology 
and  media  are  rapidly  merging,  altering  revenue  models  along 
the  way.  Marsh's  Communications,  Media  &  Technology  Practice 
offers  a  holistic  view  of  the  critical  operational  and  financial  risks 
facing  companies,  and  helps  them  find  opportunities  in  the 
new-media  space.  The  upside?  A  business  model  positioned  for 
future  growth.  To  learn  more,  visit  findtheupside.com/cmt 
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Think  of 
operational 
business 
intelligence 
as  a  cool 
sleuthing  tool  to 
help  you 
spot  ana  fix 
problems  as 
soon  as  possible 


Bl  in  All  the  Right  Places 

BY  GALEN  GRUMAN 


ANALYTICS  |  It’s  a  frustration  every  CIO  has  experienced:  Business  users  complain 
that  they’re  not  getting  the  performance  or  results  they  expect  from  their  enterprise 
applications,  yet  IT’s  investigations  continue  to  show  that  systems  are  working  within 
specifications.  At  Freescale  Semiconductor,  CIO  Sam  Coursen  faced  this  issue  when 
he  joined  the  chip  manufacturer  a  year  ago:  During  the  expensive  fabrication  process, 
some  wafers  containing  microcircuits  had  defects  that  couldn’t  be  traced.  Those  defects 
became  visible  only  after  the  wafers  had  passed  through  several  systems  or  factories. 
“Until  we  could  bring  all  the  systems  together  for  analysis,  we  couldn’t  see  the  pattern 
end  to  end,”  he  recalls,  “So  as  a  bad  process  went  on,  it  damaged  more  and  more  product. 
But  the  causes  were  not  obvious,  so  we  couldn’t  fix  it  quickly.” 

Student  loan  provider  SLM  (better  known  as  Sallie  Mae)  faced  a  similar  problem, 
recalls  Jo  Lee  Hayes,  VP  of  enterprise  technology.  Some  loan  applications  didn’t  get  com¬ 
pleted,  but  IT  couldn’t  see  what  was  causing  applicants  to  give  up.  Each  system  along  the 
way  checked  out  fine,  but  only  when  her  IT  staff  could  analyze  the  end-to-end  process  did 
it  realize  the  aggregate  state  was  flawed.  Essentially,  the  underlying  business  processes 
weren’t  meshing  well  or  delivering  as  expected.  A  portion  of  customers  would  abandon 
loans  being  processed,  and  some  percentage  of  those  customers  would  call  for  sup- 


illustration  BY  ANASTASIA  VASILAKIS 
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;  essential  technology 

port,  increasing  the  cost  of  loans.  The 
current  fix:  “With  Tealeaf  Technology 
and  Coral8  (analytics  software),  we  can 
identify  specifically  which  Web  page  the 
customer  was  on  prior  to  calling,”  Hayes 
says.  Her  team  gives  that  data  to  sup¬ 
port  agents  and  analyzes  spots  where 
the  Web  drop-offs  occur  frequently. 

One  way  CIOs  can  gain  operational 
analytics  capability  is  to  use  a  single 
application  suite  that  can  monitor  the 
relevant  data  in  the  right  context  as  it 
flows  through  the  system.  But  that’s  not 
realistic  for  enterprises.  “Processes  don’t 
fit  into  single  systems  anymore,”  Hayes 
notes.  And  although  Coursen  is  consoli¬ 
dating  many  applications  into  an  ERP 
system,  he  still  expects  to  have  at  least 
a  half  dozen  other  key  systems,  such  as 
manufacturing  execution,  product  data 
management  and  customer  relationship 
management  systems,  across  which 
processes  will  run.  “SAP’s  BI  tools  are 
only  good  for  what’s  in  SAP,”  he  notes, 
so  such  application-specific  analytics 
won’t  help. 

Both  IT  leaders  say  they  had  a  rev¬ 
elation:  While  operational  BI  requires 
a  common  platform  on  which  to  do  its 


traditional  data  warehouse  analysis, 
reporting  tools  generate  canned  reports 
each  month  for  detailed  views  of,  say, 
financial  performance,  and  analysts 
later  trudge  through  the  mounds  of 
cleansed  data. 

A  Smarter  Data  Warehouse 

By  comparison,  approaches  like  the 
ones  taken  by  Coursen  and  Hayes— 
often  dubbed  operational  BI  or  in-line 
process  analytics— let  managers  use 
current  analysis  to  make  decisions  with 
little  or  no  delay.  What  these  solutions 
don’t  do  is  replace  people  as  the  center 
of  that  decision  making. 

Generally,  the  approach  to  cross-pro- 
cess  operational  analytics  that  Coursen 
took  is  the  more  common  one,  notes 
Matthew  Liberatore,  a  professor  of 
operations  and  decision  technology  at 
Villanova  University,  currently  leading 
a  new  group  in  BI  and  analytics. 

Coursen  continues  to  rely  on  a  data 
warehouse  as  the  repository  of  mounds 
of  enterprise  data,  extracted  and  trans¬ 
formed  into  common  formats,  with  com¬ 
mon  context  and  analytic  rules  applied. 
But  he  differentiates  what  data  is  col¬ 


“We  can  tell  someone,  ‘Stop! 

You're  about  to  do  something 
suboptimalhere.”' 

-Vincent  Biddlecombe,  CTO,  Transplace 


analysis,  that  platform  need  not  be  an 
application  suite  like  ERP  or  CRM. 
For  Coursen,  that  common  platform 
is  his  data  warehouse;  for  Hayes,  it’s 
her  Web-based  transaction  environ¬ 
ment.  Both  say  they  were  able  to  bring 
business  intelligence  closer  to  business 
processes,  so  business  managers  and 
IT  staff  alike  can  now  detect  problems 
and  make  decisions  within  a  time  frame 
that  is  most  effective.  This  approach 
moves  away  from  the  time-honored  BI 
tradition  of  gathering  lots  of  data  and 
then  analyzing  it  later.  Similarly,  in 


lected,  staging  more  time-critical  data 
so  it’s  gathered  more  often.  He  also  adds 
some  operational  data  that  might  not 
otherwise  have  been  collected.  That  lets 
him  update  the  data  warehouse  with 
certain  data  on  a  daily  or  even  more  fre¬ 
quent  basis,  then  run  operationally  ori¬ 
ented  analytics  using  Tibco  Software’s 
Spotfire  tool  against  just  the  timely 
data  sets. 

The  production  data,  for  example, 
travels  to  the  data  warehouse  as  soon 
as  it  is  generated,  so  the  production 
analysis  tools  can  run  constantly,  look- 
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B I  Toolbox 

Business  intelligence  (BI)  appli¬ 
cations  and  analytics  applications 
used  to  be  distinctly  different, 
but  the  lines  have  blurred,  says 
John  Hagerty,  a  director  at  AMR 
Research.  That’s  particularly  true 
at  the  operational  analytics  level, 
where  CIOs  could  just  as  easily 
use  tools  designed  to  analyze  spe¬ 
cific  processes  or  to  do  predictive 
analysis  as  they  could  the  analyt¬ 
ics  components  of  their  BI  suites. 

Among  the  dozens  of  analytics 
vendors,  many  focus  on  specific 
industries  or  processes,  such  as 
pharmaceutical  or  transportation. 
A  new  class  of  analytics  vendors 
offers  complex  event  processing- 
analytics  geared  to  understanding 
process  flows  rather  than  just  data 
correlations.  Providers  include 
Coral8,  IBM,  Sherrill  Lubinski, 
StreamBase  Systems,  Tibco  Soft¬ 
ware  and  Truviso. 

But  to  get  to  the  analytics,  you 
first  need  to  get  to  the  operational 
data.  Among  the  many  products 
for  this  task  (beyond  the  stan¬ 
dard  extract,  transform  and  load 
products  associated  with  data 
warehouses),  the  leading  vendors 
include  Teradata  and  major  BI 
vendors  such  as  Cognos,  Busi¬ 
ness  Objects  (soon  to  be  part  of 
SAP),  Infor,  Microsoft,  Oracle’s 
Hyperion  unit  and  SAS  Institute. 

-G.G. 


ing  at  results  from  all  fabrication  stages 
at  once  to  identify  issues. 

In  essence,  the  data  warehouse  han¬ 
dles  multiple  types  of  analysis  while 
serving  as  a  single  repository  for  IT  to 
manage,  reducing  complexity.  “I  can 
leverage  all  my  previous  investments 
by  having  the  data  all  in  one  place,” 
Coursen  says,  instead  of  trying  to  ret¬ 
rofit  a  common  analytics  system  into 
multiple  applications  and  keeping  them 
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...and  the  enterprise  software  applications  project  manager 
that  will  help  you  meet  your  company's  objectives. 

I  come  equipped  with  extensive  project  management  expertise, 
earned  from  a  lifetime  of  navigating  Fortune  500  companies  through 
unpredictable  challenges. 

At  this  point  in  my  career,  I  take  on  assignments  where  I  can  make 
the  biggest  impact,  and  relish  any  opportunity  to  make  order  out  of 
disorder  and  deliver  an  error-free  platform. 

When  I  decided  to  work  with  a  technology  staffing  and  services  firm, 
it  was  clear  TEKsystems  had  the  best  reputation  and  client  roster. 
Given  their  international  footprint  and  market  leadership  position 
within  the  U.S.,  I  determined  they  alone  offered  the  widest  range  of 
opportunities.  But,  all  things  considered,  I  was  impressed  most  by 
their  professionalism,  integrity,  and  passion  to  satisfy. 

In  this  regard,  their  ability  to  match  talent  to  task  is  backed  up  by 
diligent  and  conscientious  customer  service.  All  of  which  proves  the 
point  that  as  a  client  or  a  Technical  Professional,  you  couldn't  be  in 
better  hands. 

My  name  is  Grant,  and  I  am  Technology  Execution. 

What  do  you  need  done? 

Go  to  www.teksystems.com  or  call  888-835-7978  for  more  information. 


people  you  can  trust  results  you  can  count  on 

systems 


Technology  Consulting  from  Accenture. 

Our  work  with  businesses  and  governments 
around  the  world  reveals  a  clear  pattern:  high 
performers  set  themselves  apart  by  positioning 
information  technology  as  a  strategic  asset 
and  a  partner  to  the  enterprise.  Findings  from 
our  comprehensive  ongoing  research  confirm 
that  pattern. 

Accenture  Technology  Consulting  helps  bridge 
the  gap  between  an  organization's  existing  IT 
capabilities  and  its  vision  for  high  performance. 
We  draw  upon  extensive  resources  and  experience 
to  enable  our  clients  to  achieve  their  goals: 

•  Aligning  IT  strategy  with  business  value 

•  Building  an  enterprise  architecture  "blueprint" 

•  Improving  service  levels  between  IT  and 
the  business 

•  Standardization,  consolidation  and 
virtualization  of  IT  infrastructure 

•  Consolidation  and  transformation  of  networks 

•  Maximizing  workplace  technologies  and 
collaboration  tools 

•  Improving  security  across  IT  infrastructure 
and  applications 

•  Renewing  legacy  applications  to  achieve 
greater  flexibility  and  performance 

•  Improving  IT  processes 

•  Engineering  performance  into  system  and 
application  development  life  cycles 

To  learn  more  about  Accenture  Technology 
Consulting,  visit  aceenture.com/technology 


Are  you  investing  in  IT? 
Or  just  spending  on  IT? 


How  you  perceive  your  IT  investments  may  well  determine 
what  you  get  out  of  them.  While  some  focus  on  the  outlay, 
the  highest-performing  businesses  focus  on  the  return. 
They  use  their  IT  investments  to  drive  innovation,  productivity 
and  growth.  To  see  how  Accenture  Technology  Consulting 
can  help  you  do  the  same,  visit  accenture.com/technology 

•  Consulting  •  Technology  •  Outsourcing 
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integrated  over  time. 

Like  Coursen,  Gustavo  Rodriguez, 
IT  director  at  Mexican  regional  airline 
Aeromexico  Connect  (formerly  Aero- 
litoral),  has  several  key  application 
suites  that  handle  key  operations.  So 
he  needed  a  way  to  analyze  processes 
across  them  for  the  mid-market  airline 
company.  Rodriguez  also  implemented 
a  staged  data  warehouse  that  updates 
and  analyzes  maintenance  fleet  status, 
commercial  and  finance  data,  and  sev¬ 
eral  other  operational  indicators  daily. 
This  helps  business  and  operations 
managers  adjust  schedules  and  fares 
quickly,  based  on  factors  ranging  from 
changes  in  referrals  from  partner  air¬ 
lines  to  the  effects  of  bad  weather  on 
passenger  bookings.  Some  data— such 
as  passenger  information  and  fare 
yields— is  updated  hourly  for  analysis 
by  Bitam’s  BI  tools. 

Transportation  logistics  provider 
Transplace,  also  a  mid-market  company, 
has  similarly  adopted  the  staged-data 
approach,  notes  CTO  Vincent  Biddle- 
combe— but  with  a  twist.  Because 
Transplace  has  developed  most  of  its 
transaction  systems  in-house,  it  can 
bring  some  of  the  business  rules  under¬ 
pinning  the  analytics  as  close  as  possi¬ 
ble  to  transactions  themselves.  “We  can 
tell  someone,  ‘Stop!  You’re  about  to  do 
something  suboptimal  here,’”  he  says. 
(The  person  retains  the  decision-mak¬ 
ing  authority,  since  sometimes  there’s  a 
good  reason  to  make  a  suboptimal  pro¬ 
cess  decision,  Biddlecombe  notes.) 

Transplace  IT  accomplishes  this  by 
tweaking  the  applications  to  update  the 
data  warehouse  more  frequently  and 
trigger  the  analytics  using  Microsoft’s 
BI  tools  as  part  of  certain  transactions— 
not  as  a  separate  process  for  IT  to  man¬ 
age.  “We’re  trying  to  blur  the  distinction 
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For  more  advice,  see  MANAGING  THE 
FLOW  OF  REAL-TIME  DATA  at  www.cio 
.com/article/26674 

cio.com 


between  the  transaction  system  and  the 
BI  system,”  Biddlecombe  says. 

The  staged-data  approach  does  require 
some  tweaking  to  the  traditional  report¬ 
ing  and  analysis  tools  and  to  the  data, 
says  Coursen.  Most  notably,  data  needs 
to  have  an  “as  of”  date  because  it’s  no 
longer  all  updated  simultaneously.  Some 
analyses  require  that  several  pieces  of 
data  be  updated  at  the  same  time,  so 
the  data  staging  has  to  take  that  into 
account.  Hayes  took  a  different  approach 
to  achieving  a  common  analysis  target. 
She  applied  complex  event  processing 
technology  from  Coral8  to  the  Web-based 
transaction  systems  that  customers  use  to 
manage  their  loan  applications. 

This  let  her  staff  analyze  processes 
in  real  time  based  on  the  user’s  click- 
stream  data,  regardless  of  which  loan 
application  or  back-end  transactional 
system  was  processing  the  loans.  (A 
loan  process  can  touch  as  many  as  13 
applications,  she  notes,  and  Sallie  Mae 
processes  about  20,000  loan  applica¬ 
tions  each  day,  each  of  which  involves 
multiple  business  processes.) 

The  same  technology  helps  detect 
fraud  in  real  time,  such  as  by  comparing 
a  user’s  IP  address  against  the  location 
stated  in  the  online  application  form. 

The  limitation  of  Hayes’s  approach:  It 
relies  on  Web  clickstream  data,  which 
exposes  the  current  transactions’  state 
and  associated  data  so  they  can  be  inter¬ 
cepted  in  real  time.  Hayes  hopes  that 
such  capabilities  will  be  more  available 
directly  via  enterprise  service  buses  or 
other  process-coordination  systems  as 
service-oriented  architecture  becomes 
more  widely  adopted. 

Avoid  Data  Overload 

While  it  makes  sense  to  bring  some 
analytics  closer  to  the  processes  for  key 
operations,  CIOs  need  to  be  careful  not 
to  overdo  it— for  their  own  sake  as  well 
as  for  their  users’,  says  John  Hagerty,  a 
director  at  AMR  Research.  Many  pro¬ 
cesses  don’t  need  to  be  monitored  in  real 
time  or  even  several  times  a  day,  he  notes. 
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“Clients  have  a  hard  time  consuming 
information  more  than  daily,”  Hagerty 
says.  Also,  the  infrastructure  that  is 
needed  to  analyze  the  bulk  of  enterprise 
operations  on  a  near-real-time  basis  is 
too  great  for  most  enterprises  to  justify 
the  investment,  he  says. 

And  don’t  underestimate  the  human 
issues,  which  typically  boil  down  to 
“Can  we  trust  this  is  the  right  thing  to 
do?”  Davis  says.  There’s  reason  for  that 
distrust:  People  still  need  to  make  the 
complex  calls. 

But  CIOs  can  ensure  that  those  calls 
happen  earlier  in  the  process,  when  they 
can  have  the  greatest  benefit.  “It’s  really 
an  opportunity  for  IT  to  be  a  hero  to  the 
business,”  Hayes  says.  “Business  now 
has  insight  into  completion  rate  baselines 
that  they  did  not  have  before,  as  well  as 
improved  insight  into  how  our  customers 
are  using  our  online  product.  As  the  busi¬ 
ness  absorbs  this  data,  they  can  begin  to 
optimize  our  business  processes.”  QQ 


Galen  Gruman  is  a  frequent  contributor 
to  CIO.  You  can  reach  him  at  ggruman@ 
zangogroup.com. 


DECEMBER  1,  2007  |  www.cio.com 


|  pATMeNTea 


&HOULP  NEVER 


YOUR 


If  your  datacenter  temperature  has  got  you  hot  under  the  collar,  we  can  help.  Were  Digital  Realty  Trust,  the  largest  owner  and  operator  of  datacenters  in 
the  industry.  Since  we've  purchased  and  developed  over  $2  billion  in  datacenter  assets,  we  know  a  thing  or  two  about  delivering  facilities  with  efficient  cooling 
architectures.  To  learn  more,  download  our  whitepaper,  "Cooling  Your  Datacenter"  at  www.digitalrealtytrust.com/hothead 
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Advice  for  Aspiring  CEOs 

It’s  never  too  soon  to  start  preparing  yourselt  to  become  the  boss 


emember  back  in  college,  when  you  blew  off  your  study 

group  in  favor  of  an  all-night  kegger?  Or  when  you  decided  you  could 
live  with  a  3.2  GPA  if  it  meant  meeting  more  coeds?  Most  likely,  you’ve 
experienced  some  remorse  over  strolling  through  those  four  expen¬ 
sive  years  and  not  making  the  most  of  every  learning  opportunity  How  would  your 
life  be  different  if  you  actually  took  advantage  of  all  that  your  college  had  to  offer? 


The  good  news  is  you  have  another  chance  at 
greatness.  Your  CIO  role,  if  managed  correctly,  can 
be  the  perfect  place  to  prepare  for  becoming  a  CEO. 
And  it’s  no  wonder.  With  their  unique  role  in  the 
enterprise,  CIOs  are  well  positioned  to  develop  the 
attributes  of  a  great  CEO.  As  Michael  Capellas,  for¬ 
mer  CIO  and  CEO  of  Compaq,  former  CEO  of  MCI 
and  currently,  CEO  of  First  Data,  puts  it,  “CIOs  have 
to  be  experts  at  solving  complex  problems.  They 
have  to  be  precise  and  experienced  planners,  they 
have  to  spring  into  operational  mode,  and  they  have 
to  be  more  global  than  their  peers.” 

Those  CIOs  who  take  advantage  of  the  opportu¬ 
nity  to  build  on  these  foundational  skills— rather 
than  strolling  along  in  their  current  role— may 
well  find  themselves  in  the  top  corporate  spot.  So 
what  can  CIOs  do  now  to  prepare  themselves  for 


the  corner  office?  I  asked  four  CIOs-turned-CEOs 
to  share  their  perspective  on  what  it  takes  to  become 
a  CEO. 

Learn  to  balance  internal  and  external  demands. 

“The  CEO  has  a  much  larger  group  of  external  con¬ 
stituencies  including  the  board,  investors,  partners 
and  customers,  and  has  to  know  when  to  priori¬ 
tize  the  internal  versus  the  external,”  says  Capellas. 
“When  I  became  CEO  of  Compaq,  my  first  priority 
was  to  be  the  voice  of  the  customer  and  to  go  on  100 
customer  visits  and  see  them  all.  I  thought  that  it 
was  absolutely  the  right  thing  to  do  until  I  realized 
I  was  on  the  verge  of  being  an  absentee  leader.” 

CIOs  have  a  tendency  to  prioritize  their  inter¬ 
nal  demands  over  their  external  constituents.  If 
that  is  the  case,  you  will  have  to  work  on  striking 
a  balance. 


What  happens  when  a  technological 
achievement  also  happens  to  be 
a  fashion  statement? 


Whether  they  are  a  strong  message  for  brands  in  flagship  stores,  a 
bright  centerpiece  for  high-end  home  entertainment  systems,  or  an 
image  carrier  in  business  conference  rooms  and  control  centers,  digital 
signage  solutions  from  NEC,  a  global  leader  in  IT  and  networking,  offer 
professional-grade  components  and  network  connectivity  that  reflect  a 
new  age  in  visual  communications  -  where  style  and  substance  converge 
NEC.  Empowering  you  through  innovation. 

\ 

—  www.necus.com/digitalsignage 
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Your  CIO  role,  if  managed  correctly, 
can  be  the  perfect  place  to  prepare  for 
becoming  a  CEO. 


Change  up  your  management  style.  As 

CIO,  you  manage  people  with  different  skill 
sets— application  developers,  operations  peo¬ 
ple,  project  leaders— but  most  of  them  have  a 
direct  relationship  to  IT.  “As  CEO,  you  have  a 
far  more  diverse  group  of  people  to  manage— HR,  finance, 
product  development,  sales— and  you  have  to  learn  to  relate 
to  them  in  different  ways,”  says  Capellas.  CIOs  who  find  that 
one  management  style  fits  all  will  have  to  work  some  variety 
into  their  routine  in  order  to  meet  the  CEO’s  management 
challenge. 

Run  IT  like  a  business.  For  CIOs  who  truly  aspire  to  the 
CEO  seat,  Capellas  offers  an  exercise.  “Think  of  yourself  as 
the  CEO  of  your  own  business  with  two  truly  unique  attri¬ 
butes.  Demand  for  your  services  will  always  be  higher  than 
your  ability  to  supply  them,”  he  says.  “And  everybody  is  an 
expert  in  your  consumer  business  but  nobody  understands 
your  enterprise  business.  ”  According  to  Capellas,  if  you  can 
manage  those  significant  business  conflicts  in  a  way  that 
keeps  all  your  customers  happy,  you  will  have  developed 
the  relationship  and  sales  skills  to  make  it  as  CEO. 

Develop  your  “minors.”  As  a  CIO  with  a  “major”  in  tech¬ 
nology,  you  may  have  quite  a  few  “minors”  to  develop  before 
you  are  ready  for  general  management.  Just  ask  Michael  Cur¬ 
ran.  During  the  late  ’90s,  Curran  was  promoted  from  CIO  of 
Scudder  Stevens  &  Clark  (now  Zurich  Scudder  Investments) 
to  a  series  of  general  management  roles,  including  COO.  In 
2001,  he  became  CIO  of  the  Boston  Stock  Exchange,  and  in 
2005,  he  became  its  CEO. 

“All  CEOs  have  a  major  in  something  and  they’ve  had  to 
build  their  knowledge  of  other  functions  off  of  that  core,”  says 
Curran.  CIOs  should  do  the  same,  he  says.  “Take  a  course  in 
_ _  contract  law  and  nego- 
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country  you’re  visiting, 
learn  a  foreign  language.”  With  a  pretty  serious  day  job  on 
your  hands,  you  cannot  expect  to  develop  expertise  in  each 
of  these  areas,  but  you  can,  according  to  Curran,  “get  good 
enough  so  that  you  don’t  embarrass  yourself.” 

Scale  your  conception  of  systems  relationships.  “CIOs  live 
in  a  systems  world,  and  they  understand  the  interdependen¬ 
cies  among  the  elements  of  the  systems— the  hardware,  the 
apps,  the  networks,  the  third-party  vendors,”  says  Curran.  “If 
you  can  scale  that  notion  of  interdependencies  to  a  broader 
level  that  includes  boards  and  governance,  product  manage¬ 
ment,  people,  services  and  sales,  you  will  be  able  to  adopt  the 
CEO  mind-set.” 


Plan  a  transitional  move  into  general  management.  From 

1996  to  2000,  Chris  Lofgren  served  as  CIO  of  trucking  com¬ 
pany  Schneider  National.  At  the  same  time,  he  became  presi¬ 
dent  of  its  logistics  business.  In  2000,  he  was  promoted  to 
COO.  He  became  president  and  CEO  two  years  later.  “With 
the  exception  of  a  technology  company,  it  is  highly  unlikely 
that  a  company  will  promote  a  CIO  directly  to  the  CEO  posi¬ 
tion,”  he  says.  “It  makes  more  sense  that  a  CIO  would  aim  for 
a  role  running  a  business  unit— one  that  is  driven  more  by 
information— before  attempting  the  CEO  role.” 

Expand  your  approach  to  time.  “When  planning  major 
technology  projects,  CIOs  think  about  a  one-  to  three-year 
time  frame,”  Lofgren  says.  “When  CIOs  think  about  their 
company,  their  shareholders  and  leaving  a  legacy  to  the 
next  generation  of  leadership,  the  time  frame  expands  to  a 
decade.”  As  challenging  as  technology  forecasting  is,  if  you 
start  working  long-term  goals  into  your  plans  now,  you  will 
be  better  prepared  when  your  job  demands  it. 

Report  to  the  CEO.  In  1998,  John  Andrews,  CIO  of  CSX, 
left  the  $9.6  million  railway  company  to  get  into  the  startup 
world.  After  a  few  years  of  launching  technology  compa¬ 
nies,  he  became  CEO  of  Giga  Information  Group  in  2002  and 
president  and  CEO  of  Evans  Data  in  2003.  From  his  experi¬ 
ence  on  both  sides  of  the  IT  leadership  fence,  he  believes  that 
reporting  structure  has  a  major  impact  on  whether  a  CIO  can 
gain  the  right  experience  for  the  CEO  role. 

“If  you  report  to  the  top  and  have  a  seat  at  the  table,  you 
have  a  much  better  perspective  of  what  it  takes  to  be  a  CEO,” 
says  Andrews.  “You  have  a  broader  view  of  the  business  and 
an  opportunity  to  collaborate  at  his  or  her  level.  If  you  are 
reporting  to  the  CFO,  you  are  one  layer  removed  from  where 
the  action  is  and  you  need  to  make  a  change.” 

Be  sure  you  want  the  job.  “While  the  CIO  role  does  have 
similarities  to  the  CEO  role,  the  CEO  role  is  a  major  step  up 
in  terms  of  scale,  pressure,  constituency  influence,  time  com¬ 
mitment  and  external  visibility,”  says  Andrews.  “You  don’t 
want  to  make  the  leap  before  you’re  ready.”  If  you  quake  at 
the  thought  of  having  your  every  move— your  acquisitions, 
sales  forecasts,  hirings  and  firings— scrutinized  by  share¬ 
holders,  the  government,  Wall  Street  and  the  public,  you 
may  want  to  think  again  about  vying  for  the 
job.  BE] 


Martha  Heller  is  managing  director  of  the  IT  lead¬ 
ership  practice  at  ZRG,  an  executive  recruiting  firm 
in  Boston.  Reach  her  at  mheller@zrgroup.com. 


tiation,  learn  balance 
sheets,  learn  something 
about  marketing.  If 
you’re  working  globally, 
read  a  book  about  each 
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Grow  your  enterprise 

without  outgrowing  your  storage. 
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Consensus  Builder 

You  need  rules  for  running— and  using— IT.  And  the  people  who  have 
to  live  with  these  rules  need  to  help  make  them.  That’s  the  best  way  to 

ensure  that  your  IT  policies  won’t  constrain  your  business. 

. 

- 

Danny  was  military,  and  he  makes  sure  you  know  it.  His 

colleagues  grumble  that  he  acts  like  he’s  the  commander.  Danny 
likes  discipline  and  controls,  especially  when  he’s  the  one  with  his 
hand  on  those  controls. 

As  assistant  to  the  CIO,  Danny  was  put  in  charge  of  policy.  He  was  dubbed  the 
“policy  czar.”  Danny  set  about  violating  my  Golden  Rule  of  Organizational  Design: 


Never  separate  accountability  from  authority.  In 
doing  so,  he  set  himself  up  as  a  policy  decision 
maker  rather  than,  as  he  should  have  been,  a 
policy  facilitator. 

Who  Decides  IT  Policies? 

Policies  are  constraints  on  the  way  we  work— a 
“how  to”  procedure  or  a  “you  must”  requirement. 
The  dictionary  defines  policy  as  “a  definite  course 
or  method  of  action  selected  from  among  alterna¬ 
tives  and  in  light  of  given  conditions  to  guide  and 
determine  present  and  future  decisions.” 

A  policy,  once  established,  narrows  one’s  choices 
about  what  to  do,  how  to  do  it  or  which  alternative 
to  choose.  Danny,  as  you  can  see  from  the  following 
exchange,  enjoyed  his  authority  to  prescribe  choices 
for  the  rest  of  his  organization. 


During  a  leadership-team  meeting  that  I  attended 
as  a  consultant,  I  asked  Danny  which  policies  he  felt 
he  was  responsible  for.  His  answer  was,  “All.”  (I  was 
disconcerted  that  he  neglected  to  add  “sir”  to  the 
end  of  his  terse  reply.  I  thought  that  was  policy.) 

“All?”  I  asked  incredulously. 

“All,”  he  replied  assertively. 

“Even  those  that  apply  to  a  single  line  of  busi¬ 
ness,  like  the  policy  on  what  gets  connected  to  the 
network?”  I  queried. 

“Absolutely,”  Danny  answered.  He  seemed 
annoyed  that  I  had  the  insolence  to  ask. 

Undaunted,  I  pressed  on.  “How  do  you  go  about 
setting  policies?”  I  inquired. 

Danny  described  a  process  that  was  essenti¬ 
ally  this: 

■  Danny  decides  which  policy  to  work  on  next. 
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Policies  reduce  people's  choices  and  can  make  an  organization 
less  flexible ,  more  bureaucratic  and  less  creative.  But  a  well- 
chosen  and  well-written  policy  does  more  good  than  harm  by 
establishing  a  consistent,  meticulous  process  or  necessary 
constraints  that  help  leaders  run  an  efficient,  customer-focused, 
safe  and  reliable  business. 


setting  priorities  from  among  a  list  of  potential  policies  that 
he  generates,  as  well  as  considering  requests  by  others  within 
the  department. 

■  Danny  drafts  the  policy,  perhaps  drawing  on  his  peers 
as  subject-matter  experts. 

■  After  a  private  briefing  by  Danny,  the  CIO  approves  the 
policy  (in  some  cases  with  the  input  of  a  steering  committee 
representing  the  business  units). 

■  Danny  enforces  compliance. 

The  Problem  With  Top-Down 
Policy-Setting 

I  looked  around  the  room  at  Danny’s  peers,  and  then  asked 
one  final  question.  “Danny,  you  said  you  are  responsible  for 
all  policies,  even  those  that  affect  only  a  single  line  of  busi¬ 
ness.  Who  here  is  accountable  for  the  safe,  reliable,  efficient 
operation  of  the  network?” 

Without  hesitation,  Danny  pointed  to  Rob,  the  head  of  the 
network  operations  group. 

And  now  we  see  the  crux  of  the  problem:  How  can  Rob 
be  held  accountable  for  the  quality  of  service  of  his  net¬ 
work,  while  Danny  is  deciding  policies  that  dictate  how 
Rob  does  business? 

This  is  a  violation  of  that  Golden  Rule.  Rob,  with  account¬ 
ability  but  without  concomitant  authority,  wasn’t  empowered 
to  run  his  business  his  way;  yet  he  was  still  held  accountable 
for  results.  A  cynic  might  say  that  he  was  set  up  to  become  a 
victim  and  a  scapegoat. 

On  the  other  hand,  even  if  Danny  accepted  Rob’s  input 
on  the  policy,  Danny’s  power  to  write  the  policy  (and  his  de 
facto  power  to  get  it  approved)  gave  him  authority  over  Rob’s 
business.  With  authority  but  no  accountability,  Danny  could 
easily  become  a  tyrant.  His  peers  feared 
exactly  this. 

Compounding  this  problem,  the  man¬ 
agers  didn’t  have  the  authority  to  estab¬ 
lish  the  policies  they  needed  to  run  their 
businesses.  Danny  became  a  bottleneck; 
he  could  work  on  only  a  few  policies  at  a 
time,  and  he  chose  his  priorities.  What¬ 
ever  he  didn’t  think  was  important 
enough  sat  at  the  bottom  of  the  list. 

For  example,  Allie  is  responsible  for 


intranet  services.  Her  clients  have  asked  for  an  enterprise 
instant  messaging  service,  but  she  has  delayed  deploy¬ 
ment  for  two  years,  awaiting  a  policy  regarding  its  use. 
Her  proposed  policy  is  still  in  the  hopper  awaiting  Danny’s 
consideration. 

The  need  for  policies  was  not  in  question.  This  IT  depart¬ 
ment  had  grown  in  size  and  complexity,  and  it  needed  to 
mature.  It  needed  to  improve  its  consistency,  safety,  reliabil¬ 
ity,  efficiency,  resource  controls  and  business  focus.  Policies 
were  necessary  to  facilitate  all  these  goals.  But  the  way  Danny 
implemented  them  demoralized  the  staff  and  threatened  the 
performance  of  the  entire  IT  organization. 

Ways  Policy-Setting  Can  Be  Distributed 

The  IT  organization’s  problem  centers  on  who  has  the  power 
to  decide  policy.  If  Rob  is  to  be  held  accountable  for  the  qual¬ 
ity  of  service  of  his  network,  then  Rob— and  only  Rob- 
should  be  empowered  to  determine  policies  on  its  operation 
and  its  use. 

In  general,  according  to  the  Golden  Rule,  policies  should 
be  determined  by  the  individual  or  team  that  is  accountable 
for  whatever  business  is  constrained  by  these  policies. 

For  example,  some  policies  apply  to  the  entire  enterprise. 
Think  about  security  policies  for  passwords,  and  the  rules 
for  using  the  corporate  intranet.  Policies  that  affect  the  entire 
enterprise  should  be  decided  by  a  consensus  of  the  leaders 
of  the  enterprise.  As  difficult  as  that  may  be  to  achieve,  it’s 
the  only  way  to  ensure  that  the  policy  reflects  everybody’s 
input  and  is  by  far  the  best  means  of  gaining  enterprise¬ 
wide  compliance. 

Other  policies  apply  to  the  IT  department.  A  policy  for 
getting  IT  to  work  on  your  projects  might  state  that  if  you 
wish  to  do  business  with  IT,  your  project 
must  either  be  funded  through  an  estab¬ 
lished  portfolio-management  process  or 
you  must  show  up  with  cash  in  hand. 
Such  policies  affecting  one  department 
should  be  decided  by  the  head  of  the 
department,  ideally  with  the  consensus 
of  his  or  her  leadership  team. 

A  third  group  of  policies  applies  to  a 
specific  line  of  business  within  a  depart¬ 
ment.  For  example,  the  network  opera- 


Best  Policies 


One  of  today's  big  IT  policy 
headaches:  MANAGING  MOBILE 
DEVICES.  Read  how  CIOs  at  Aflac, 
Primerica  and  other  companies 
handle  the  challenge  at  www 
.cio.com/article/28177.  Read 
how  Northrop  Grumman  sets  I.D. 
MANAGEMENT  POLICIES  at  www 
.cio.com/article/14774. 
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tions  group  may  establish  a  policy  that  says  that  if  you  don’t 
meet  certain  safety  requirements,  you  cannot  connect  to  the 
backbone  network  inside  the  corporate  firewall.  One  could 
even  use  the  word  policy  to  describe  the  operating  proce¬ 
dures  within  a  group,  such  as  how  problems  are  handled  in 
a  call  center  and  which  design  tools  and  methods  are  used 
to  engineer  applications. 

Policies  that  affect  a  single  group  (such  as  network  opera¬ 
tions)  should  be  decided  by  the  leader  of  that  group.  Policies 
that  affect  a  number  of  groups  within  a  department,  though 
not  the  whole  department,  should  be  decided  by  a  consensus 
of  the  leaders  of  those  affected  groups. 

The  Role  of  a  Policy  Group 

Is  there  any  circumstance  in  which  Danny’s  approach  might 
work?  Consider  those  policies  that  are  departmentwide  and 
hence  should  be  decided  by  the  CIO  and,  ideally,  her  leader¬ 
ship  team. 

Even  here,  Danny  had  it  upside  down.  He  declared  himself 
the  “prime  contractor”  for  policy  development  and  consid¬ 
ered  the  subject-matter  experts  his  “subcontractors.”  That 
is,  Danny  felt  that  he  was  accountable  for  the  delivery  of 


policies,  and  others  were  there  to  help  him  do  so.  Danny  was 
selling  other  people’s  expertise  (in  the  form  of  the  content 
of  policies). 

However,  the  purpose  of  a  policy  group  is  to  help  others 
translate  their  expertise  into  policies,  not  to  do  it  for  them 
(or  to  them).  An  effective  policy  group  “sells”  the  following 
products  and  services  to  its  peers: 

■  Policy  process  facilitation.  A  policy  group  can  help  an 
organization’s  leadership  team  accumulate,  prioritize  and 
come  to  consensus  on  departmentwide  policies,  and  it  can 
facilitate  enterprisewide  consensus  on  enterprise  policies. 
In  this  role,  the  policy  group  is  strictly  a  process  facilitator, 
not  an  author,  decision  maker  or  “czar.” 

■  Policy  editing  and  advice.  It  can  help  subject-matter 
experts  craft  well-worded  policies,  providing  expertise  in 
how  to  define  and  phrase  an  effective  policy.  This  expertise 
can  help  everyone  write  policies  that  are  practical  and  effec¬ 
tive  without  being  bureaucratic,  inflexible,  disempowering 
or  expensive  to  administer. 

■  Policy  library.  It  can  maintain  a  repository  of  policies, 
communicate  their  availability,  and  help  people  access  and 
interpret  existing  policies. 
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Policies  that  affect  the  entire  enterprise 
should  be  decided  by  a  consensus  of  the 
leaders  of  the  enterprise.  As  difficult  as  that 
may  be  to  achieve,  it's  the  only  way  to  ensure 
that  the  policy  reflects  everybody's  input 
and  is  by  far  the  best  means  of  gaining 
enterprise  wide  compliance. 


A  policy  group  should  not  be 
responsible  for  the  content  of  the 
policies  or  have  any  authority 
over  that  content.  And  it  must 
never  be  involved  in  auditing 
compliance.  This  would  be  a  con¬ 
flict  of  interest.  No  one  can  both 
serve  others  (policy  facilitation) 
and  stand  in  judgment  of  others 
(audit)  without  undermining  the 
teamwork  between  the  policy  group  and  its  peers. 

Why  All  This  Work 
Is  Necessary 

Policies  are  inherently  risky.  They  reduce  people’s  choices 
and  can  make  an  organization  less  flexible,  more  bureau¬ 
cratic  and  less  creative. 

But  in  many  cases,  policies  are  necessary.  A  well-chosen 
and  well-written  policy  does  more  good  than  harm  by  estab¬ 
lishing  a  consistent,  meticulous  process  or  necessary  con¬ 
straints  that  help  leaders  run  an  efficient,  customer-focused, 
safe  and  reliable  business. 


The  key  to  an  effective  approach  is  to  make  all  parties 
accountable  for  policies  within  their  respective  businesses 
and  to  provide  them  with  the  help  of  a  policy  facilitation  func¬ 
tion  (not  a  “czar”)  that  serves  its  peers  rather  than  attempting 
to  control  them.  BO 


N.  Dean  Meyer  writes  Beneath  the  Buzz  on  CIO. 
com,  where  he  critiques  popular  IT  management 
concepts.  He  is  the  founder  of  NDMA,  a  business 
strategy  consultancy.  Contact  him  at  dean@ndma 
.com.  To  comment  on  this  article,  go  to  the  online 
version  at  www.cio.com/article/150801. 
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COVER  STORY  |  IT  Complexity 


Special  Olympics  CIO  Andre Mendes: 
“When  you  reduce  complexity,  you  increase 
your  ability  to  implement  new  solutions." 


Today,  all  CIOs  are  standing  in  the  path 
of  a  fire  hose  spewing  complexity. 

And  many  are  getting  soaked. 

THE  COMPLEXITY  ADD 

Within  IT,  factors  that  increase  complex¬ 
ity  include  outsourcing  management, 
the  adoption  of  Web  and  consumer  tech¬ 
nologies,  support  for  mobile  workforces, 
developing  and  managing  technology 
architectures  and  governance  for  those 
workforces,  and  ensuring  security  in  a 
distributed  environment. 

Outside  of  IT’s  direct  control,  com¬ 
plexity  is  increased  by  the  requirements 
of  compliance,  the  need  to  support  global 
business,  and  the  speed  and  depth  of 
access  to  information  demanded  by  your 
customers  and  your  partners. 

CIOs  can— with  difficulty— handle 
these  challenges  individually,  one  at  a 


time.  But  in  the  real  world 
CIOs  face  many,  if  not  all,  of  these  chal¬ 
lenges,  all  at  once,  over  and  over.  “That’s 
why  you  need  a  strategy  to  keep  complex¬ 
ity  out  of  the  environment,  not  just  have 
knee-jerk  responses,”  Modruson  says. 

The  challenge  of  complexity  is  exacer¬ 
bated  by  the  fact  that  many  organizations 
have  technology  systems  that  have  been 
built  up  over  time  or  acquired  through 
acquisitions  or  complicated  by  many 
waves  of  vendor  consolidation.  For  these 
companies,  moving  forward  requires  an 
almost  archaeological  effort  to  unearth, 
understand  and  work  with  all  these  layers 
of  sedimentary  technology.  This  digging 
causes  the  delays  that  frustrate  business 
executives  and  CIOs  alike  whenever 
change  or  progress  is  needed,  says  Mark 
McDonald,  group  vice  president  for  Gart¬ 
ner  executive  programs. 


Worse,  fundamental  changes  in  busi¬ 
ness  are  making  the  complexity  chal¬ 
lenges  harder  than  ever.  “I  don’t  see  an 
end  to  complexity.  Technology  continues 
to  change,  and  business  demand  for  ser¬ 
vices  continues  to  increase,”  says  Wal- 
Mart  CIO  Rollin  Ford.  This  means  that 
even  CIOs  who  are  good  at  managing 
complexity  can  never,  ever  rest.  And  those 
who  are  not  good  at  it  are  at  risk  of  allow¬ 
ing  their  organizations  to  fall  behind. 

Some  CIOs  have  figured  out  ways  to 
escape  the  complexity  trap.  They  reduce 
complexity  where  possible;  they  live  with 
what  remains;  they  still  invest  in  new 
technologies  that  can  lead  to  business 
success.  But  there’s  no  silver  bullet.  You 
can’t  buy  simplicity.  And  you  can’t  hand 
off  the  problem  to  a  service  provider.  No 
one  lives  in  the  complexity  space;  no  one 
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THE  VALUE  _ 

A  CIO  dialogue  on  Innovation  and  Technology 


Following  is  an  excerpt  from  their  discussion. 

The  full  webcast  is  available  at  www.cio.com/ 
webcasts/ 'sponsored/ redhat! innovation. 

GARY  BEACH:  Ted,  what  role  does  IT  play  in 
creating  top-line  growth  in  your  organization? 

TED  MAULUCCI:  It  allows  us  to  change  our 
business  model  and  enable  new  ways  to  sell.  One 
of  our  primary  businesses  is  selling  condominiums. 
Because  we’ve  automated  and  integrated  all  of  our 
systems  to  such  a  high  level,  you  can  put  an  entire 
sales  office  in  a  laptop.  So,  right  now  were  simulta¬ 
neously  selling  Toronto  product  in  Shanghai, 

Korea,  Calgary  and  Vancouver.  The  other  thing 
that  it’s  done  is  it’s  driven  a  lot  of  costs  out. 

BEACH:  Phil,  what  about  at  Tiffany? 

PHIL  ALBERTA:  In  the  retail  space,  we  are  able 
to  manage  customers,  manage  merchandise,  and 
extend  things  like  our  web  platform  globally  to  sell 
product  as  well  as  move  product.  And  it  has  created 
a  lot  of  opportunities  to  grow  revenues  primarily, 
but  also  add  to  some  efficiencies. 

BEACH:  Susan,  what  role  do  you  see  IT  playing 
in  driving  top-line  growth? 

SUSAN  CRAMM:  Primarily  in  the  realm  of 
removing  the  inhibitors  to  grow.  So,  when  we  think 
about  supply  chain  and  insuring  that  the  process  is 
in  scale,  that’s  a  real  focus  area.  Another  one  has  to 
do  with  ensuring  that  customer  information  is 
available  throughout  the  organization — from  the 
front-line  salesforce  up  through  the  organization. 


BEACH:  Ted,  do  you  believe  that  IT  execs  now  are 
more  business  people  than  technology  executives? 

MAULUCCI:  Definitely.  I  would  say  from  my 
own  perspective,  I  spend  80  percent  of  my  time  on 
a  business  side  rather  than  on  a  technical  side.  The 
value  comes  when  you  look  at  the  technology  and 
figure  out  how  to  make  it  different. 

BEACH:  Phil,  what  are  you  doing  at  Tiffany? 

ALBERTA:  I  agree  wholeheartedly  with  Ted. 
We’ve  gotten  better  at  ingesting  new  technology. 
It’s,  “How  do  we  become  a  strategic  advantage  to 
the  business  as  opposed  to  a  service?”  I  think  80 
percent’s  probably  the  right  amount  of  time  we 
spend  on  business  questions,  business  process, 
business  problems. 

BEACH:  Susan,  would  you  agree  with  Phil  and 
Ted  in  terms  of  80  percent? 

CRAMM:  Oh,  I’m  going  to  be  a  contrarian  here. 
Until  we  are  able  to  really  get  a  focus  on  measuring 
value,  I  think  we’re  still  going  to  be  an  expense  to 
be  minimized.  Virtually  anybody  I  work  with  is 
always  fighting  for  dollars.  And  it’s  not  a  question 
of,  “Gee,  how  much  can  we  give  you  because  we 
know  you’re  such  a  good  return?”  It’s,  “Why  do 
you  need  it?”  And  that,  I  think,  is  fundamentally 
our  challenge  from  a  leadership  standpoint. 

BEACH:  Anuj,  what’s  your  point  of  view? 

KUMAR:  I  would  kind  of  balance  it  out.  I 
would  say  I  would  agree  with  Susan  for  probably 
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“/  spend  80 
percent  of  my 
time. on  a 
business  side 
rather  than  o?i  a 
technical  side.  ” 
-  TED  MAULUCCI 


almost  half  the  customer  base  that  we  come  across, 
But  I  would  say  the  traditional  businesses  are  still 
stuck  in  the  camp  of,  “It’s  still  a  cost.  How  do  we 
take  it  out?  How  do  we  get  more  competitive  the 
traditional  way?” 

BEACH:  Phil,  what  are  some  of  the  interesting 
technologies  that  you’re  looking  at? 

ALBERTA:  On  the  technology  side,  it  is  around 
mobility.  Things  like  virtualization,  I  would  agree 
are  not  something  I  talk  to  anyone  about  but  my 
own  team. 


BEACH:  What  about  Open  Source?  What  are  you 
doing  there? 


ALBERTA:  We  do  very  little  of  our  own  in-house 
development  anymore.  So,  most  of  the  packages  we 
buy  are  very  retail-oriented.  We  will  ingest  Open 
Source  as  we  can  and  as  necessary.  We  look  forward 
to  it,  actually. 


BEACH:  Susan,  what  are  you  seeing  [from] 
customers  that  excite  them  in  terms  of  disruptive 
technologies? 


CRAMM:  Service-oriented  architectures  and  web 
services — the  very  large  financial  services  firms  are 
way  ahead  on  that.  But  the  second-tier  kind  of 

organizations  would 
like  to  have  more  of  a 
chance  to  get  their 
hands  on  it.  They’re 
wanting  to  do  more 
things  in  the  Open 
Source  area;  they’re 

From  left,  Ted  Maulucci,  Phil  Alberta,  Susan  Cramm,  wanting  to  do  more 

Anuj  Kumar  and  Gary  Beach.  things  on  virtualization. 


BEACH:  Anuj,  from  your  observation  of  your 
customers,  what  percent  of  their  IT  infrastructure 
is  leveraged  on  Open  Source  now,  and  is  it  truly  an 
IT  priority? 

KUMAR:  Almost  80  percent  of  trades  on  Wall 
Street  are  done  on  Open  Source.  If  you’ve  ever 

Custom  Solutions  Group  .  . . . . . . — . . . . . 


bought  anything  online,  90  percent  of  it  is  done 
Open  Source.  So  if  you  look  behind  the  scenes,  at 
how  much  business  it’s  affected,  it’s  huge.  Now,  is 
it  a  priority?  It’s  not  a  question  of,  “if  I  should  do 
it,”  or  even  “when  I  should  do  it.”  It’s  really 
“Where  and  how  I  would  go  do  it,”  because  it’s 
now  become  a  viable  business  model.  People  are 
seeing  the  business  benefits  of  it. 

BEACH:  In  terms  of  virtualization  at  Red  Hat, 
where  does  it  rank  among  [your  CIO’s]  priorities? 

KUMAR:  It’s  pretty  high  on  the  list.  What’s 
happened,  I  think,  in  the  last  five  years  is  [virtual¬ 
ization  has]  been  commoditized.  Intel  is  putting  it 
on  its  chip.  AMD  is  putting  it  on  its  chip,  which 
actually  gets  it  to  the  masses.  So  you’ll  find  uses  for 
virtualization  that  you  never  knew  existed;  it’s  there 
for  you  to  use  it  when  you  want  it,  [in  ways  that 
were]  not  there  when  you  bought  it. 

BEACH:  Phil,  Ted  was  saying  that  in  six  months, 
80  percent  of  his  infrastructure  is  going  to  be 
virtualized.  Looking  into  the  future,  what  percent 
do  you  think  it’ll  be  at  Tiffany? 

ALBERTA:  We’re  striving  for  80  right  now,  but 
the  philosophy  is  virtualize  first  and  then  tell  me 
why  it  can’t  be  virtualized.  We’re  very  comfortable 
virtualizing  single  servers.  Our  Exchange 
environment  is  virtualized  one  server  on  one  host. 

BEACH:  What  percentage  are  you  running  in 
Open  Source  at  Tiffany  and  is  it  on  your  priority  list? 

ALBERTA:  I  think  Open  Source  for  us,  in  a  very 
different  way  than  virtualization,  isn’t  a  topic  unto 
itself.  It’s  part  of  the  solution.  It’s  part  of,  “What  are 
we  doing  next?  What’s  the  best  way  to  do  that?”  I 
think  the  thing  we’ve  done  is  made  ourselves  open 
and  ready  to  accept  Open  Source. 

MAULUCCI:  From  my  perspective,  it’s  just 
gaining  comfort  with  it.  I  know  I’m  moving  with 
it.  I’ve  already  made  decisions  toward  it.  It’s  just 
feeling  more  comfortable  [with  it].  We  will  go 
there.  It’s  going  to  happen.  ■ 


Want  to  hear  more t  The  conversation  continues  at  www.cio.com/webcasts/sponsored/redhat/itinovation. 
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More  than  500  of  your  peers  in  the  CIO  Executive  Council 

are  collaborating  on  issues  essential  to  the  IT  community  —  and  beyond. 

Since  the  CIO  Executive  Council's  inception  in  2004,  members  have  participated  in  hundreds 
of  peer-to-peer  calls  and  interactive  group  meetings  —  enabling  them  to  connect  to  one 
another  at  any  time,  on  any  topic.  Change  management,  software  licensing  practices, 
expanding  the  role  of  the  CIO,  applying  the  right  Web  2.0  strategy,  getting  today’s  youth  inter¬ 
ested  in  IT  —  these  are  just  some  of  the  upcoming  issues  our  members  will  tackle. 


Join  the  discussion.  To  view  more  upcoming  CIO  Executive  Council  meet¬ 
ings  or  to  recommend  discussions  most  relevant  to  you  and  your  enterprise,  visit 
www.cioexecutivecouncil.com/community. 


CIO  Executive  Council 


The  CIO  Executive  Council  was  created  by  readers  of  CIO  magazine  and  leaders  within  the 
community  of  CIOs  to  leverage  the  individual  and  collective  strengths  of  its  members,  to  serve 
as  unbiased  and  trusted  advisors  to  each  other  and  to  advance  the  CIO  profession  and  its  role  in 
driving  shareholder  results  for  their  respective  organizations.  In  just  three  short  years  the  CIO 
Executive  Council  has  grown  to  over  500  CIOs  worldwide,  representing  executive  leadership  in 
organizations  with  approximately  $2.5  trillion  (USD)  in  annual  revenues. 

For  information  on  membership,  please  visit  www.cioexecutivecouncil.com. 
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Some  things  are  better  left  untouched. 

Before  you  start  that  big  transition 
to  VoIP,  hold  the  phone.  It  may  not 
be  the  grand  reconstruction  project 
they've  been  talking  about.  Simply 
stated,  it  isn't  about  ripping  and 
replacing  or  big,  upfront  costs.  That's 
because  it  isn't  about  hardware. 

It's  actually  about  software. 

Now  you  can  keep  your  hardware — 
your  PBX,  your  gateways,  even  your 
phones.  Move  to  VoIP  with  software. 
Software  that  integrates  with  Active 
Directoryf  Microsoft® Office,  Microsoft 
Exchange  Server,  and  your  PBX. 

Maximize  your  current  PBX 
investment  and  make  it  part  of  your 
new  software-based  VoIP  solution 
from  Microsoft.  It's  big  change, 
without  changing  it  all.  Learn  more  at 
microsoft.com/voip 


Your  potential.  Our  passion.' 

Microsoft 
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IT  Complexity 


has  a  packaged  solution  to  the  complex¬ 
ity  problem.  The  truth  is  that  you  need  a 
strategy  that  reduces  complexity,  and  you 
need  the  tactical  ability  to  implement  that 
strategy  up  and  down  your  organization. 

Although  there’s  no  single  formula  that 
will  work  for  everyone,  IT  leaders  and 
consultants  have  identified  four  broad 
principles  for  reducing  complexity: 

First,  make  process  central  to  your  IT 
organization’s  approach  to  technology. 

Second,  you  need  superior  governance 
of  both  the  technology  infrastructure  and 
the  business-IT  relationship. 

Third,  everything  you  do  must  have 
simplicity  as  the  default  expectation. 

Fourth,  your  efforts  must  be  ongoing. 
Complexity  is  not  something  you  get  rid 
of  once  and  for  all.  It’s  a  battle  you  wage 
every  day. 

FIRST  CURE:  PROCESS- 
DRIVEN  ARCHITECTURE 

An  architectural  approach  is  essential 
to  managing  complexity,  says  Motorola 
CIO  Patty  Morrison,  and  you  need  one 
mapped  to  business  objectives. 

“You  very,  very  much  need  to  have  an 
end-state  architecture  in  place— a  descrip¬ 
tion  of  where  you’re  headed,”  she  says. 
That  architecture  cannot  simply  be  for 
the  IT  infrastructure— the  network,  the 
data  flow  to  and  from  the  ERP  systems, 
the  security  checkpoints,  the  application 
monitors,  and  so  on.  IT-oriented  archi¬ 
tectures  tend  not  to  take  into  account  the 
flexibility  needed  to  support  changing 
business  processes.  Rather,  Morrison 
says,  the  CIO’s  architecture  has  to  be 
driven  first  by  key  business  processes. 

Imagine  what  a  failure  a  plane’s 
design  would  be  if  its  creators  didn’t  take 
into  account  the  fact  that  different  cus¬ 
tomers  may  have  different  uses  for  the 
planes— some  desiring  multiple  classes, 
some  looking  for  different  cargo-passen¬ 
ger  ratios,  some  serving  long-haul  desti¬ 
nations  and  others  short-haul.  Ignoring 
those  factors  would  result  in  a  plane  that 
flew  but  couldn’t  adapt  to  its  customers’ 
business  needs.  The  seats  might  be  mov¬ 
able  but  not  the  lighting— a  seemingly 
minor  detail,  but  one  that  might  prevent 


airlines  from  configuring  the  seating  to 
differentiate  between  first  class  and  coach. 
In  the  same  way,  a  business  with  a  tech¬ 
nology  architecture  that  isn’t  created  in 
service  of  current  and  anticipated  busi¬ 
ness  needs  will  be  limited  in  what  it  can 
do.  Change  will  require  expensive  retro¬ 
fitting  of  technology  to  handle  what  the 
architecture  hasn’t  anticipated. 


But,  she  acknowledges,  it’s  not  easy  to 
achieve  this  state.  It  requires  that  business 
units  think  beyond  their  immediate  needs 
and  work  with  other  units  toward  a  com¬ 
mon  approach. 

“The  hardest  thing  for  IT  to  do  is  to 
get  business  units  to  agree  on  a  common 
way  to  do  something,”  says  Morrison. 
That  takes  maturity  in  working  across 


“The  hardest  thing  for  IT  to  do 
is  to  get  business  units  to  agree  on 
a  common  way  to  do  something.” 

-MOTOROLA  CIO  PATTY  MORRISON 


At  Motorola,  Morrison  ensures  that 
her  architecture  accommodates  and  antic¬ 
ipates  business  goals  by  using  business 
process  management  (BPM)  principles 
and  an  enterprise  reference  architecture 
to  define  a  common  language  for  busi¬ 
ness  and  IT.  The  enterprise  reference 
architecture  is  a  broad  set  of  blueprints 
that  shows  the  business,  operations  and 
systems  layers. 

This  approach  also  ensures  that  busi- 
ness-IT  conversations  don’t  devolve  into 
throwing  requirements  over  the  wall,  an 
approach  that  usually  adds  complex¬ 
ity  in  two  ways.  One  is  that  IT  fulfills 
the  business’s  requirements  outside  the 
overall  architecture,  often  leading  to 
multiple  ways  of  doing  the  same  thing. 
These  processes  must  then  be  reconciled, 
which  frequently  requires  custom  inter¬ 
faces  for  other  systems  that  no  one  (cer¬ 
tainly  not  the  business)  realized  would 
be  affected.  The  other  complexity  add 
comes  from  IT’s  interpretation  of  those 
over-the-wall  requirements.  It  usually 
misses  something,  leading  to  multiple 
rounds  of  rework  and  patches  that  make 
the  final  system  ever  more  complex.  By 
contrast,  the  architecture-based  approach 
at  Motorola  “creates  a  rich,  interactive, 
high-quality  conversation  around  real 
solutions,  not  abstracted  requirements,” 
says  Morrison. 


silos.  Without  it,  business  units  end  up 
clamoring  for  their  own  unique  variants 
of,  say,  customer  information.  And  that 
adds  complexity. 

With  the  architectural  groundwork 
established,  Motorola  uses  modeling 
tools  first  to  design  the  desired  business 
processes  and  then  to  simulate  and  test 
various  technological  approaches  to  deliv¬ 
ering  them.  For  example,  Motorola  used 
this  approach  to  reduce  part  qualification 
cycle  time— a  process  of  evaluating  which 
suppliers’  parts  meet  the  quality,  cost  and 
other  requirements  for  planned  Motorola 
products— from  28  weeks  to  seven  weeks 
in  2006  while  improving  visibility  and 
controls  over  the  process. 

Having  an  enterprise  reference  archi¬ 
tecture  doesn’t  mean  an  organization  has 
an  immutable  plan.  Because  both  busi¬ 
ness  and  technologies  change,  you  can’t 
always  have  a  multiyear  plan  for  a  specific 
result,  says  Mack  Murrell,  vice  president 
of  IS  at  Dow  Chemical.  For  example,  you 
shouldn’t  develop  a  service  technician 
scheduling  system  that  depends  on  a 
specific  wireless  network,  or  is  limited  to 
servicing  only  the  kinds  of  products  you 
currently  offer.  Instead,  “you  want  a  set  of 
options  within  your  target,”  he  says. 

For  example,  you  would  ensure  the 
application  is  network- agnostic  and  sup¬ 
ports  both  always-on  connections  and 
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Increased  efficiencies 
and  decreased  risks  across 
ABN  AMRO's  4500  branches 
in  53  countries. That's 


TATA 


A  business  with  millions  of  customers  globally,  called  for  an  innovative  and  holistic  approach  to 
increase  its  client  satisfaction,  with  decreased  time  to  market  and  reduced  costs  world  over. 
To  achieve  this,  ABN  AMRO  needed  a  comprehensive  IT  solution  that  would  increase  efficiencies 
and  minimize  risks  in  its  daily  operations.  An  IT  solution  not  just  for  the  immediate  time  frame 
but  for  the  future  as  well.  As  one  of  the  world's  fastest  growing  technology  and  business 
solutions  providers,  Tata  Consultancy  Services  (TCS)  helped  ABN  AMRO  make  a  seamless 
transition  to  a  new  system  by  leveraging  a  methodology  developed  by  TCS'  Innovation  Labs. 
Ensuring  that  ABN  AMRO  was  a  step  ahead  in  reassuring  its  customers  of  a  higher  and  better 
level  of  service.  And  of  course,  enabling  ABN  AMRO  to  experience  certainty. 

TATA  CONSULTANCY  SERVICES 

Experience  certainty. 

IT  Services  ■  Business  Solutions  ■  Outsourcing 


To  learn  how  your  business  can  experience  certainty,  visit  www.tcs.com 
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The  New  Complexity  Add 

As  if  things  weren’t  complicated  enough... 

The  nutty  pace  of  technology  change  is  old  news,  but  now  a  whole  new 
stream  of  change  is  aimed  at  the  CIO:  the  consumer  technologies  that 
increasingly  are  being  used  by  both  employees  and  customers. 

“In  a  few  years,  100  percent  of  people  in  the  most  attractive  demo¬ 
graphic— 18-  to  35-year-olds— will  be  digital  natives,  and  their  expectations 
are  being  set  in  that  environment,"  says  Mark  McDonald,  group  VP  for  exec¬ 
utive  programs  at  Gartner.  That  means  MySpace,  Facebook,  iPods,  iPhones, 
Google  Maps,  instant  messaging,  blogs.  And  the  list  goes  on. 

The  problem  with  consumer  tech  is  that  it’s  rarely  designed  with  enter¬ 
prise  systems  in  mind,  so  to  fit  it  into  the  enterprise  architecture  adds  com¬ 
plexity.  An  iPhone,  for  example,  doesn't  have  disk  encryption,  creating  a 
security  hole.  “For  consumer-oriented  technologies,  one  of  the  biggest  issues 
is  data  security  since  these  technologies  are  so  easily  lost  or  stolen,”  says 
John  Petrey,  CIO  of  TD  Banknorth.  “There's  added  complexity  to  support  the 
various  technologies  used  to  connect  and  sync  with  corporate  systems.” 

The  key  to  embracing  consumer  tech  in  the  enterprise  is  to  change  the 
terms  of  engagement,  McDonald  says.  After  all,  what  the  CIO  wants  is  a 
consistent  set  of  processes  and  technologies  to  manage;  whether  they 
come  in  the  form  of  an  iPhone,  BlackBerry  or  Treo  shouldn’t  matter. 

McDonald  cites  the  wireless  LAN  market  as  a  historic  example.  Once 
there  was  a  reliable  standard  (802.11b),  enterprises  could  manage  the 
technology,  and  wireless  devices  became  commonplace. 

McDonald  admits  that  consumer  tech  vendors,  as  they  jockey  for  lock- 
in  advantage,  typically  don’t  adhere  to  such  standards— and  their  custom¬ 
ers  couldn’t  care  less.  But  he  sees  a  tipping  point  emerging  where  such 
standards  will  be  developed  either  by  vendors  seeking  to  broaden  their 
sales  or  by  decisions  CIOs  make  that  push  the  vendors  to  respond  in  kind. 

CIOs  need  to  assume  that  many  consumer  technologies  will  become 
mainstream  in  the  enterprise,  just  as  the  Web  has. 

“I  like  to  think  of  it  as  an  opportunity  to  reduce,  not  add,  complexity,” 
says  Motorola  CIO  Patty  Morrison.  “Enterprises  that  leverage  consumer 
technologies  allow  their  people  to  better  manage  the  convergence  of  per¬ 
sonal  and  professional  demands.  These  are  the  enterprises  that  will  win. 

“It  really  changes  the  existing  paradigms  of  end-user  services  within 
the  enterprise,"  she  says— challenges  such  as  integration  and  security 
notwithstanding.  -G.G. 


intermittent  connections.  You  would 
not  hard-code  product  specifications  but 
would  instead  rely  on  a  metadata  approach 
that  supports  a  range  of  possible  product 
characteristics,  and  could  support  a  vari¬ 
ety  of  information  types  (say,  video  and 
PDF)  even  if  they’re  not  needed  today. 

That  requires  an  architecture  that 
anticipates  and  enables  change.  To  do 
this,  Dow  deconstructs  its  enterprise 
architecture  into  discrete  subsets  (such 
as  purchasing,  plant  maintenance  and 
pricing)  and  layers  (such  as  business  sys¬ 
tem,  technical  and  products).  Dow  uses 
structured  enterprise  architecture  meth¬ 
ods  and  service-oriented  architecture 
approaches  to  manage  the  subsets  and 
the  changing  relationships  among  them 
within  the  overall  architecture. 

Dow  has  a  group  of  IT  and  business 
staff  whose  job  is  to  track  these  subsets 
and  make  sure  they  conform  to  the  overall 
architecture— or  adapt  the  architecture  if 
that’s  what’s  needed. 

SECOND  CURE: 

GOOD  GOVERNANCE 

Ironically,  as  Accenture  CIO  Modruson 
notes,  “Complex  things  tend  to  be  easier 
to  design  and  deploy.”  Many  enterprises 
justify  Rube  Goldberg-type  systems  by 
saying  they  need  them  now  and  promising 
themselves  that  they’ll  clean  up  the  tech¬ 
nology  later.  But  “later  never  happens,” 
Modruson  says  dolefully.  Strong  central 
governance  can  prevent  that  “let  the  future 
worry  about  it”  mentality.  “Organizations 
that  have  effective  IT  governance  by  and 
large  have  lower  levels  of  IT  complexity,” 
notes  Gartner’s  McDonald. 

That’s  why  CIOs  and  their  business 
partners  must  have  strong  governance 
“about  what  really  impacts  our  customer, 
with  business  a  key  part  of  that  decision 
structure,”  says  Michael  Vincent,  CIO  of 
global  financial  services  provider  ING. 

Having  that  fundamental  business 
understanding— and  a  common  view  of 
it  in  both  business  and  technology  leader¬ 
ships— provides  the  CIO  with  the  ability 
to  make  decisions  that  prevent  unneces¬ 
sary  complexity  and  also  enables  him  to 
more  accurately  assess  the  costs  and  ben¬ 


efits  of  any  desired  technology.  It  enables 
him,  Vincent  says,  to  figure  in  the  impact 
of  complexity  not  just  on  deployment 
but  also  on  maintenance  and  integration, 
which  consumes  about  70  percent  of  IT’s 
budget.  It  also  allows  him  to  gauge  how  a 
technology  will  affect  future  changes  to 


both  the  business  and  the  IT  infrastruc¬ 
ture.  “This  customer  focus  helps  show 
which  requests  are  too  complex  for  the 
value  provided,”  says  Vincent. 

Of  course,  CIOs  are  always  under  pres¬ 
sure  to  respond  quickly  to  business’s 
urgent  priorities,  and  an  IT  leader  will 
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have  an  end-state  architecture  in  place— a 
description  of  where  you’re  headed.” 


inevitably  need  to  make  some  complex¬ 
ity  trade-offs  for  truly  critical  demands. 
But  you  can’t  let  that  pressure  subvert  the 
principles  of  good  governance. 

“If  we  find  ourselves  living  in  a  ‘get  it 
done’  mode  for  extended  periods,  the  red 
flag  goes  up,”  says  Wal-Mart’s  Ford.  By 
having  a  seat  at  the  executive  committee 
table,  Ford  can  make  sure  the  red  flag  is 
not  ignored. 

This  joint  IT-business  approach  to  deci¬ 
sion  making  should  also  extend  to  deci¬ 
sions  on  what  technology  products  and 
services  are  purchased— even  for  technolo¬ 
gies  that  the  CIO  is  not  directly  responsible 
for  managing,  says  John  Petrey,  CIO  of 
financial  services  provider  TD  Banknorth. 

“In  some  cases,  a  business  unit  might 
go  out  and  contract  for  services  such  as 
Salesforce.com.  That  starts  out  as  a  silo 


with  no  messaging  or  inte¬ 
gration  with  existing  apps. 
But  later,  that  messaging  or  integration 
becomes  desirable  and  then  the  complex¬ 
ity  factor  for  IT  rises,”  Petrey  says.  What 
seemed  like  an  isolated  technology  ends 
up  needing  to  connect  to  core  systems, 
requiring  retrofit  work. 

The  CIO’s  involvement  in  these  out- 
side-of-IT  decisions  can  help  ensure  con¬ 
formity  to  standards  and  architectures, 
says  Petrey,  reducing  current  or  future 
complexity  issues  that  could  affect  the 
business  units,  not  just  IT.  “You  want  to 
look  for  the  best  fit  to  business  needs  and 
minimum  complexity  through  the  gover¬ 
nance  process,”  he  says. 

When  evaluating  the  complexity  impli¬ 
cations  of  any  business  or  IT  effort,  CIOs 
will  need  to  accept,  in  some  cases,  more 
complexity  than  is  ideal  because  of  the 
business  benefit,  says  Vincent.  For  exam¬ 


ple,  ING  is  buying  various  transaction 
systems  in  its  fast-growing  Asian  opera¬ 
tions  to  handle  a  surge  in  demand.  And 
although  ING  is  re-architecting  some  of 
its  global  systems  for  more  common  pro¬ 
cesses  and  technology,  the  Asia  business 
can’t  grow  if  it  has  to  mark  time  while  that 
effort  is  completed.  Vincent  knows  he’ll 
need  to  rework  the  Asia  operations  even¬ 
tually,  but  that  will  cost  ING  less  than  the 
revenues  it  might  miss  by  waiting. 

Understanding  this  trade-off  up  front 
ensures  that  the  price  of  the  complexity- 
add  is  apparent  early  on,  preparing  the 
ground  for  later  investments  that  will  be 
needed  to  clean  things  up. 

In  ING’s  approach,  complexity  factors 
are  fundamental  to  the  joint  business-IT 
decision-making  process,  not  only  alert¬ 
ing  business  to  the  price  to  be  paid  for  its 
requests,  but  also  helping  IT  avoid  over¬ 
complicating  what  it  delivers. 
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THIRD  CURE: 

DEFAULT  TO  SIMPLICITY 

“It’s  harder  to  do  simple,  but  it’s  better  to 
do  simple,”  says  Accenture’s  Modruson, 
because  the  more  difficult  task  of  simpli¬ 
fying  the  design  up  front  results  in  easier 
implementation  down  the  road. 

In  2005,  Motorola’s  Morrison  says, 
she  had  60  customer  data  models.  That 
made  application  and  business  process 
integration  extremely  difficult.  Then  the 
business  requested  an  accounts  receiv¬ 
able  project,  and  Morrison  used  it  as  a 
driver  to  simplify  those  60  data  mod¬ 
els.  “We  established  a  global  common 
customer  master  data  model;  we  didn’t 
make  it  optional.  All  projects  now  use  it 
as  a  blueprint,”  she  says.  “The  result  is 
we  now  work  on  one  customer  master; 
we  modify  and  maintain  one,  as  opposed 
to  a  mountain  of  them.  It’s  just  a  massive 
reduction  in  work  and  overhead,  and  an 
improvement  in  agility.” 

It’s  easy  to  end  up  with  unnecessary 
complexity  due  to  technological  and  busi¬ 
ness-process  diversity,  notes  Fifth  Third 
Bancorp  CIO  Raymond  Dury.  “Each  addi¬ 
tional  technology  wasn’t  a  tipping  point;  it 
was  just  one  more  thing.  But  at  some  point 
you  realize  you’ve  reached  a  tipping  point 
where  simplifying  is  a  benefit.” 

“Mature  companies  need  disciplined 
teams  and  change  controls  to  minimize 
the  risk  [of  increasing  complexity].  That’s 
why  they’ve  failed  in  the  past;  they  don’t 
look  at  the  lifecycle,”  says  Wal-Mart’s 
Ford.  “All  of  a  sudden,  they  hit  the  wall.” 

But  driving  to  simplicity  can  be  tricky. 
It’s  hard  to  get  resources  to  revamp  older 
systems  or  to  pay  for  the  initial  architec¬ 
tural  efforts.  And  the  work  can  take  years. 
“It  can’t  take  too  long;  otherwise  people 
will  seek  exceptions.  So  you  need  to  get 
resources  fast,”  Morrison  warns.  Some 
of  those  resources  need  to  come  from 
your  internal  savings,  some  in  the  form 
of  business  investments.  Internal  savings 
typically  come  from  two  areas:  efficien¬ 
cies  and  vendor  management. 

CIOs  can  achieve  efficiencies— and 
reduce  IT  complexity  along  with  costs— 
through  a  variety  of  complementary 
tactics,  including  disciplined  data  man¬ 


agement,  employing  change-control 
techniques  to  their  application  develop¬ 
ment  and  integration  efforts,  using  Six 
Sigma  techniques  for  post-deployment 
defect  management,  increasing  automa¬ 
tion,  deploying  cost-savings  technologies 
such  as  virtualization,  outsourcing  some 
technologies,  “ruthlessly”  standardizing 
(using  Accenture’s  Modruson’s  adverb), 
consolidating  duplicate  technologies  and 
retiring  older  systems.  “When  you  do 
things  rationally,  you  can  actually  cut  the 
budget,”  says  Special  Olympics’  Mendes, 
as  he  discovered  when,  as  CIO  of  PBS  a 
few  years  ago,  he  cut  the  interconnec¬ 
tion  asked  from  the  federal  government 
from  $177  million  to  $120  million  while, 
he  says,  introducing  new  technology  that 
substantially  improved  services. 


The  key  area  to  focus  on  internally  is 
your  data  architecture,  says  Motorola’s 
Morrison.  “If  you  focus  on  master  data— 
customer,  pricing,  bills  of  materials  and 
so  on— and  get  those  very  defined,  the 
number  of  applications  you  have  will 
become  less  of  a  complexity  problem,” 
she  maintains.  That’s  because  much  of 
the  integration  effort  across  applications 
involves  managing  all  the  point-to-point 
data  transformations  when  applications 
interact.  Having  a  consistent  data  archi¬ 
tecture  eliminates  much  of  that  effort  by 
allowing  one  to  use  repeatable  processes 
at  the  integration  layer.  That  results  in 
both  immediate  and  long-term  savings 
that  can  help  the  CIO  make  other  effi¬ 
ciency  and  simplification  investments. 

Two  approaches  to  achieving  savings 


and  simplification— technology  consoli¬ 
dation  and  retirement— can  be  tricky, 
notes  Peter  Ruggerello,  VP  of  applications 
development  of  pharmaceutical  distribu¬ 
tor  AmerisourceBergen,  because  there 
are  often  undocumented  dependencies 
between  what  you  want  to  keep  and  what 
you  want  to  get  rid  of.  A  classic  example 
is  that  “a  customer  order  entry  system  is 
being  retired  and  you  find  that  a  job  to 
receive  EDI  [electronic  data  interchange] 
orders  was  using  the  same  subsystem  to 
validate  data  received  before  it  was  passed 
on  to  a  new  process  in  the  back-end  order- 
entry  systems,”  he  says. 

That’s  no  reason  to  shy  away  from  get¬ 
ting  rid  of  technologies  that  are  no  lon¬ 
ger  needed,  but  it  does  require  mapping 
dependencies— and  keeping  the  map 


updated— so  you  can  remove  the  older 
technologies  more  efficiently  when  the 
time  comes,  Ruggerello  suggests. 

Accenture  spent  quite  a  bit  of  effort 
when  in  2004  it  replaced  450  financial 
applications  with  a  single  SAP  ERP 
instance,  and  migrated  277  of  its  280 
business  applications  to  a  single  platform. 
More  recently,  the  consultancy  undertook 
the  same  consolidation  effort  with  its 
recruiting  systems,  replacing  46  with  one. 
“Today,  we  have  a  theory  of  one:  We  have 
just  one  of  anything,”  Modruson  says. 

“Even  though  it  was  hard  to  get  there, 
what  we  have  today  is  a  lot  better,”  says 
Modruson.  The  cost  of  IT  as  a  percent¬ 
age  of  net  revenue  has  been  cut  in  half,  he 
notes,  with  a  “significant”  portion  coming 
from  reduced  complexity. 
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Reducing  the  Complexity  Tax 

Enterprises  that  simplified  two  aspects  of  theirfinancial 
systems— having  high  standardization,  such  as  a  unified  chart  of 
accounts,  and  common  applications,  such  as  a  single  ERP 
system-spent  23 percent  less  on  theirfinance 
efforts.  Enterprises  that  reduced  complexity  in  additional 
areas  averaged  an  extra  21  percent  in  savings. 

SOURCE:  The  Hackett  Group 


V. 


Paradoxically,  achieving  savings 
through  consolidation  isn’t  achieved 
merely  by  consolidating.  “You  can  take  30 
inefficient  data  centers  and  create  three 
inefficient  data  centers  from  them,”  warns 
ING’s  Vincent.  “What  takes  the  most  time 
[to  do  it  right]  is  figuring  out  what  your 
target  is.  Only  with  that  in  place  can  you 
optimize  the  operations,”  he  says.  It’s 
the  Goldilocks  principle  of  determining 
what’s  just  right,  being  just  as  simple  as 
you  need  to  be. 

The  easily  appreciated  benefits  of  con¬ 
solidation  include  reducing  license  costs 
(by  reducing  the  number  of  licenses  you 
need)  and  personnel  (by  having  fewer  data 
center  managers).  But  these  savings  are 
finite.  Once  you  achieve  them,  you’re  done. 
You  can  accomplish  more  by,  for  example, 
moving  to  different  types  of  servers  or 
adopting  new  approaches  such  as  virtu¬ 
alization.  But  these  require  thinking  first 
about  what  the  future  needs  of  your  orga¬ 
nization  are  likely  to  be  and  how  changes 
to  your  processes  might  anticipate  them,  or 
at  least  not  get  in  the  way,  Vincent  says. 

Savings  through  vendor  management 
typically  come  as  a  result  of  consolidation, 
Fifth  Third’s  Dury  notes.  The  basic  equa¬ 
tion,  he  says,  is  simple:  “If  you’ll  share  these 
efficiencies  with  us,  you’ll  get  more  of  our 
business.”  Savings— and  simplifications— 
can  also  come  from  educating  your  ven¬ 
dors  about  your  architecture,  says  ING’s 
Vincent,  “so  they  don’t  bring  incompatible 
products  to  the  table.”  Another  way  to  use 
your  vendors  to  reduce  complexity  is  to 
challenge  each  one  to  identify  two  existing 
products  that  you  can  eliminate  by  buying 


their  one,  says  Gartner’s  McDonald. 

Such  internal  improvements  cannot 
be  undertaken  just  for  IT’s  sake.  The  real 
goal  remains  serving  business’s  chang¬ 
ing  needs  by  having  a  responsive,  flexible 
technology  base. 

FOURTH  CURE: 

CONTINUOUS 

IMPROVEMENTREQUIRED 

It  can  be  tempting  to  try  to  buy  your  way 
out  of  complexity  by  outsourcing  as  much 
of  your  IT  as  you  can  get  away  with  or  by 
adopting  big-ticket  platforms  from  any 
one  of  a  hundred  vendors  that  will  swear 
they  can  solve  all  your  problems. 

“We  went  ERP  in  2000.  It  simplified 
our  landscape  by  getting  rid  of  legacy  sys¬ 
tems.  We  cleared  out  the  old  and  brought 
in  the  new,”  recalls  Anthony  Bosco,  CIO 
of  engineering  and  facilities  management 
firm  Day  &  Zimmermann.  Bosco  believes 
that  having  a  fairly  closed  technology 
system  or  platform  encourages  simplic¬ 
ity  because  it  discourages  the  addition  of 
single-point  technologies. 

However,  enterprises  have  multiple 
needs,  which  means  they  will  need 
multiple  systems.  And  when  adding 
technologies  is  necessary,  you  get  added 
complexity,  Bosco  concedes,  especially 
where  they  duplicate  some  of  each  oth- 
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er’s  processes.  “It  worked  for  a  while,”  he 
adds,  but  the  complexity  started  creeping 
back  as  the  business’s  new  needs  required 
new  technologies  not  anticipated  by  the 
ERP  developers.  “The  ERP  systems  of 
today  are  the  legacy  of  tomorrow,”  Bosco 
sums  up.  He’s  handling  this  conundrum 
by  tying  each  platform  to  a  specific  set  of 
business  needs,  such  as  ERP  for  financial 
management  and  e-commerce  for  online 
transactions.  He  enforces  a  disciplined  set 
of  links  among  them  to  prevent  complex¬ 
ity  caused  by  use  of  duplicate  processes. 

A  seductively  easy  fix  for  complexity  is 
to  hand  over  your  technology  to  someone 
else.  That’s  a  bad  idea,  says  Bernard  “Bud” 
Mathaisel,  CIO  of  software  outsourcing 
provider  Achievo.  When  a  company  is 
stable,  says  Mathaisel,  it’s  more  efficient 
and  costs  less  to  manage  well-designed 
key  infrastructure,  such  as  data  centers, 
in-house.  Outsourcing  makes  sense  when 
a  company  is  in  transition,  such  as  during 
a  merger,  or  in  a  period  of  high  growth, 
and  you  don’t  have  the  human  or  manage¬ 
ment  resources  available.  “That’s  worth 
the  premium  cost,”  he  says. 

Outsourcing,  unfortunately,  may  not 
reduce  complexity  so  much  as  shift  it, 
notes  John  Baschab,  president  of  man¬ 
agement  services  at  consultancy  Techni- 
source:  “Outsourcing  turns  a  technical 
challenge  into  a  management  one.” 

And  outsourcing  per  se  won’t  fix  overly 
complex  subsystems.  Sounding  an  ironic 
note,  Ramesh  Dorairaj,  head  of  applica¬ 
tion  management  services  at  Mindtree 
Consulting,  says  that  “offshoring  merely 
arbitrages  inefficiency  at  a  lower  cost.” 

Some  organizations  follow  a  cyclical 
approach  to  dealing  with  complexity. 
Every  five  years  or  so,  they  embark  on  a 
simplification  effort  to  reset  the  technol¬ 
ogy  base  to  something  that  can  be  used  as 
a  platform  for  future  growth.  In  theory, 
this  can  work,  especially  for  industries 
that  have  boom-and-bust  cycles;  the  bust 
times  are  when  you  can  make  the  invest¬ 
ments  for  the  next  boom  period.  But  this 
approach  has  three  flaws,  says  Daryl 
Plummer,  chief  of  research  for  emerg¬ 
ing  trends  and  process  management  at 
Gartner.  One  is  that  enterprises  rarely 
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invest  when  times  are  tight.  Two  is  that 
it  requires  a  large  shift  in  skills  and  pri¬ 
orities  that’s  hard  for  people  to  handle. 
Three  is  that  waiting  lets  the  problem  fes¬ 
ter,  leading  to  workarounds  by  impatient 
users  that  will  contribute  to  complexity 
down  the  road. 

“Occasionally,  the  window  for  big-proj¬ 
ect  change  does  exist— maybe  5  percent  of 
the  time,”  says  Mathaisel.  “Take  advan¬ 


tage  of  it  when  you  can.  But  95  percent  of 
the  time  you’re  really  talking  about  incre¬ 
mental  change.  You  do  what  you  can  today 
and  deal  with  the  rest  on  a  later  cycle.” 

There’s  also  bigger  risk  for  large-scale 
retrofits  embarked  on  during  down  times, 
warns  Wal-Mart’s  Ford.  It’s  precisely 
during  the  tough  times  that  the  business 
comes  to  IT  for  help.  So  counting  on  sim¬ 
plifying  your  technology  environment 
then  is  probably  not  realistic. 

The  best  approach  is  to  make  the  work 
of  simplification  ongoing,  says  Dow’s 
Murrell.  “Look  in  every  area  to  see  what’s 
redundant,”  he  recommends.  That  doesn’t 
necessarily  mean  doing  anything  to  sim¬ 
plify  the  technology  cans  you’ve  opened. 
“You  may  make  a  decision  to  leave  the 
worms  in  there  due  to  the  cost  or  the  delay 
to  value,”  Murrell  says.  But  you  should 
document  what  could  have  been  simpli¬ 
fied  and  why  you  didn’t  make  the  effort,  so 
the  next  time  that  particular  can  is  opened 
it’ll  be  easier  to  determine  if  that’s  the  right 
time  to  get  rid  of  the  worms. 

Ultimately,  says  TD  Banknorth’s 


Petrey,  you  need  to  reduce  complexity  in 
the  legacy  technology  you’re  not  retiring. 
“If  you  don’t,”  he  says  ominously,  “the 
consequences  to  your  business  will  come 
at  a  point  not  of  your  choosing. 

“It’s  not  a  sexy  thing  to  do,”  he  con¬ 
tinues,  “and  the  business  doesn’t  see  the 
value  in  it,  but  if  you  let  it  go,  you’ll  end  up 
with  complexity  and  fragility.”  Not  a  good 
combination. 


Staging  simplification  efforts  over  time 
is  a  critical  strategy  for  success,  argues 
ING’s  Vincent:  “Take  bite-sized,  digestible 
chunks;  otherwise,  you’ll  choke.  Replace  a 
brick  at  a  time,  not  a  whole  building.” 

THE  HIGHEST  COMPLEXITY 
FACTOR:  YOUR  JOB 

It  may  seem  as  if  the  complexity  burden 
has  become  too  great  to  bear.  But  CIOs 
have  been  there  before,  says  Accenture’s 
Modruson,  and  not  only  have  they  sur¬ 
vived,  they’ve  thrived:  “In  the  1980s, 
everyone  stitched  together  networks 
from  multiple  technologies.  Things  have 
gotten  better  as  technology  complexities 
have  collapsed.” 

For  example,  CIOs  used  to  worry  about 
what  network  technology  to  choose;  now 
it’s  all  IP-based  and  no  longer  something 
on  which  CIOs  need  to  focus.  Similarly, 
server  technologies  have  collapsed  into 
a  few  well-known  quantities  that  CIOs 
can  rely  on.  “These  are  standard  plat¬ 
forms  I  don’t  have  to  worry  about,”  says 
Special  Olympics’  Mendes.  “I  can  target 


business  value  instead.” 

“A  decade  ago,  we  moved  to  new  tech¬ 
nologies  quickly  because  the  old  ones 
weren’t  so  good.  But  now  we  can  be  more 
measured  because  what  is  now  the  old 
stuff  does  work,”  Modruson  says. 

What’s  changed  is  that  the  complex¬ 
ity  has  migrated.  As  parts  of  the  IT  envi¬ 
ronment  became  standardized,  such  as 
networks,  other  issues  replaced  it,  such 
as  securing  porous  enterprise  boundar¬ 
ies  and  managing  massive  data  sets  in  a 
world  where  budgeting  for  downtime  for 
maintenance  and  backup  is  simply  not 
acceptable  to  the  business.  And  emerg¬ 
ing  process-management  approaches 
such  as  service-oriented  architecture 
that  promise  to  reduce  the  complexity  of 
application  integration  and  development 
introduce  complexities  elsewhere,  such  as 
in  change  management  and  testing,  notes 
TD  Banknorth’s  Petrey. 

A  more  fundamental  shift  has  been  away 
from  a  focus  on  infrastructure  technologies 
to  technologies  that  deliver  business  pro¬ 
cesses.  The  IT  infrastructure  continues 
to  pose  its  own  complexity  challenges,  but 
it’s  now  just  table  stakes— part  of  the  CIO 
job— and  why  business  needs  CIOs  who 
are  both  business-  and  process-oriented. 

CIOs  must  play  at  several  levels  simul¬ 
taneously,  addressing  both  business  and 
IT  needs,  keeping  the  systems  running 
while  ensuring  that  their  technology 
strategy  supports  business  operations, 
promotes  innovation  and  provides  com¬ 
petitive  advantage  in  a  changing  environ¬ 
ment,  says  Michael  Farber,  a  vice  president 
at  consultancy  Booz  Allen  Hamilton.  “It’s 
a  3-D  chess  board,”  he  notes. 

At  most  companies,  “the  CIO  ends  up 
at  the  tail  end  of  things,”  stuck  with  com¬ 
plexities  caused  by  others,  says  Dave  Zink, 
client  executive  at  consultancy  EquaTerra 
and  former  CIO  of  CBS.  “But  when  compa¬ 
nies  have  elevated  the  CIO  to  the  right  level, 
they  are  less  likely  to  have  complexity.” 

Assuming  they  have  a  CIO  who  can 
play  a  mean  game  of  3-D  chess.  ui!i 


Galen  Gruman  can  be  reached  at  ggruman@ 
zangogroup.com.  To  comment  on  this  article, 
go  to  www.cio.com/author/41292. 


“A  business  unit  might  go  out  and  contract 
for  services  such  as  Salesforce.com. 

That  starts  out  as  a  silo  with  no  messaging 
or  integration  with  existing  applications. 
But  later,  as  needs  evolve,  messaging  or 
integration  becomes  desirable  and  the 
complexity  factor  rises.” 

-TD  BANKNORTH  CIO  JOHN  PETREY 
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IT  and  the  Law 


Now  that  e-mails  and  electronic  documents  have 
attained  the  same  evidentiary  status  as  paper, 

CIOs  need  to  standardize  processes  for  e-discovery 

BY  JUDI  HASSON 


Reader  ROI 

::  The  importance  of 
creating  a  retention 
and  deletion  policy 

::  Technologies  that  can 
support  e-discovery 
processes 

::  Why  IT  and  legal  must 
be  joined  at  the  hip 


No  one  wants  to  be  sued.  But  in  today’s 
litigious  world,  it’s  rare  that  any  company  will 
escape  a  lawsuit  in  the  course  of  its  business 
life.  And  it’s  becoming  the  CIO’s  job  to  make 
sure  that  when  that  unhappy  time  comes,  IT  is 
ready  for  the  flood  of  directives  to  turn  over  all 
relevant  electronic  documents.  That’s  where  the 
headaches  start  for  any  IT  department  that  does 
not  have  a  good  e-mail  retention  and  retrieval 
system. 

The  need  for  better  electronic  record  keep¬ 
ing  evolved  a  year  ago  when  the  federal  gov¬ 


ernment  overhauled  its  rules  of  civil  procedure 
and  made  electronic  documents  an  official  part 
of  the  discovery  process  during  a  lawsuit.  The 
rules  for  what  is  called  “e-discovery,”  which 
took  effect  Dec.  1,  2006,  make  production  of 
electronic  documents  as  important  as  turning 
over  hard  copies  of  materials  in  any  legal  case. 
Companies  typically  have  30  days  to  answer 
any  e-discovery  request  (though  the  court 
may  grant  extensions).  If  they  fail  to  respond 
promptly,  they  face  thousands  of  dollars  in 
fines  and  even  risk  forfeiting  the  case. 


64  DECEMBER  1,  2007  |  www.cio.com 


BearingPoint 


Management 

&Technology 

Consultants 


The  Risk  of  Lost  Opportunity 

It’s  every  bit  as  important  as  the  other  risks  that  threaten  a 
company's  success  — security,  compliance,  credit,  technology, 
operational,  financial,  geopolitical,  market. 


i 


n 


BearingPoint  understands  this.  And  knows  how  to  help  companies 
seize  opportunity  rather  than  run  from  the  risks  surrounding  it. 


That's  why  The  Forrester  Wave:  Risk  Consulting  Services  2Q2007 
named  us  a  leader  in  risk  consulting: 


BearingPoint  showed  an  ability  and  willingness  to  move  beyond 
technology  to  focus  on  more  of  the  organizational,  role,  and 
process  issues  for  risk  management.'' 

Find  out  how  we  can  help  you  seize  opportunity.  Download  the 
white  paper  “Where  Risk,  Compliance  and  Security  Intersect"  at 
w.  bearingpoint.com/risk 


e  are  BearingPoint. 

^Management  and  Technology  Consultants. 


I  1.866.  BRNGPNT 


IT  and  the  Law 


“Too  many  CIOs  think  of  litigation  as 
something  that  belongs  to  the  legal 
department.  Litigation  is  something 
that  belongs  to  the  company  as  a  whole.” 

-LESLIE  WHARTON,  E-DISCOVERY  HEAD,  ARNOLD  AND  PORTER 


In  this  new  world  that  marries  the  legal 
system  with  technology,  the  CIO  has  to 
add  corporate  archivist  to  his  job  descrip¬ 
tion.  Consequently,  IT  departments  must 
work  with  their  legal  departments  to 
come  up  with  a  plan  that  saves  critical  e- 
mails  and  makes  them  easily  retrievable. 
Unfortunately,  there  are  few  rules  for 
setting  up  an  electronic  records  manage¬ 
ment  system,  a  paucity  of  best  practices 
for  training  employees  to  catalog  their  e- 
mail  and  no  guidelines  for  creating  pro¬ 
cedures  that  employees  will  consistently 
follow  to  ensure  prompt  and  comprehen¬ 
sive  production  of  subpoenaed  electronic 
documents.  And  so  many  CIOs  are  still 
scrambling  to  figure  out  a  way  to  organize 
and  keep  track  of  their  corporate  e-mail. 

But  people  are  working  on  the  prob¬ 
lem.  According  to  legal  experts  and  IT 
leaders  who  are  tackling  the  issues,  the 
key  to  compliance  with  e-discovery  rules 
is  to  establish  enterprisewide  document 
management  and  retention  practices  for  e- 
mail  and  other  types  of  digital  documents, 
and  then  deploy  the  appropriate  software 
to  support  them.  “You  can  achieve  a  lot  of 


protection,  reduce  your  risk  and  reduce 
the  cost  of  discovery  by  adopting  reason¬ 
able,  repeatable  and  scalable  processes 
and  tools,”  says  John  Rosenthal,  a  partner 
and  cochair  of  the  e-discovery  committee 
at  Howrey,  a  Washington,  D.C.,  law  firm. 

Here  are  five  strategies  for  getting 
ready  for  the  inevitable: 

The  Five  Rules 
of  E-Compliance 

1.  BUILD  A  TEAM 

“The  problem  with  e-discovery  is  the  first 
time  it  hits  your  radar  screen  is  when  the 
general  counsel  calls  and  tells  you  what 
the  court  wants,”  says  Paul  Zazzera,  a 


consultant  and  former  CIO  at  Time  Inc. 
In  order  not  to  get  caught  with  your  pants 
down,  IT  and  legal  should  work  to  develop 
processes,  policies  and  tools  for  saving  e- 
mail  that  everyone  in  the  company  under¬ 
stands  and  follows.  “A  CIO  and  the  legal 
department  should  be  fused  at  the  hip,” 
Zazzera  says. 

And  don’t  leave  business  leaders  out 
of  the  discussion.  “Too  many  CIOs  think 
of  litigation  as  something  that  belongs  to 
the  legal  department,”  says  Leslie  Whar¬ 
ton,  head  of  the  e-discovery  team  at  the 
Arnold  and  Porter  law  firm.  “Litigation  is 
something  that  belongs  to  the  company  as 
a  whole,  and  whether  you’re  a  plaintiff  or 
defendant,  the  company  must  be  able  to 


Your  E-DISCO VERY  Tool  Kit 

A  burgeoning  supply  of  products  and  services  gives  CIOs  a  wide  range  of  options 


John  Rosenthal,  a 

partner  and  cochair  of  the 
e-discovery  committee 
at  Howrey,  a  Washington, 
D.C.,  law  firm,  says  it  may 
cost  between  $1  million  and 
$2.5  million  for  a  company 
to  prepare  for  e-discovery, 
depending  on  the  tools 
it  needs.  Paul  Zazzera,  a 
consultant  and  former  CIO 
at  Time  Inc.,  says  a  large 
company  with  10,000 
employees  might  spend 
$500,000  for  “entry  level” 
e-discovery  tools  and  train¬ 
ing  that  include  basic  e-mail 
retention  and  retrieval  capa¬ 
bilities.  “When  you  reach 


beyond  e-mail,  the  number 
can  quickly  grow  beyond  $1 
million,”  he  adds. 

A  small  firm  might 
spend  its  money  more 
wisely  implementing  bet¬ 
ter  document  manage¬ 
ment  processes  instead  of 
technology.  Because  small 
companies  (they  hope) 
don't  face  as  many  lawsuits 
as  larger  companies,  e-dis- 
covery  experts  say  it's  more 
important  for  smaller  enter¬ 
prises  to  ensure  that  they 
save  records  in  a  consistent 
and  reliable  way. 

The  bottom  line,  accord¬ 
ing  to  e-discovery  experts, 


is  that  waiting  until  the  last 
minute  to  deploy  technol¬ 
ogy— when  the  e-discovery 
order  comes— can  be  more 
costly  than  planning  ahead. 
“We're  all  feeling  our  way,” 
Zazzera  says.  “Discovery  is 
expensive.” 

Here’s  a  short  list  of  avail¬ 
able  tools  and  services: 

Attenex  provides  tools 
for  law  firms  to  standardize 
e-discovery  procedures. 

Zantaz,  a  subsidiary  of 
Autonomy,  supports  discov¬ 
ery  and  review  processes 
without  requiring  a  reviewer 
to  code  or  tag  documents. 

Digital  Mountain  pro¬ 


vides  tools  for  collecting, 
processing  and  analyzing 
electronic  data  for  law  firms. 

EnCase  is  a  suite  of 
products  by  Guidance  Soft¬ 
ware  to  search  and  retrieve 
electronic  data.  It  can  find 
data  across  a  network  from 
a  centralized  location. 

First  Advantage  pro¬ 
vides  litigation  support  ser¬ 
vices  including  e-discovery 
and  data  recovery  services. 

Stratify  products  include 
the  Stratify  Legal  Discovery 
Service,  which  provides  a 
search  tool  that  can  handle 
300  documents  an  hour. 

-J.H. 
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IT  and  the  Law 


“If  executives  imagine  their  e-mails  blown  up 
on  a  highway  billboard,  that’s  exactly  how  it 
looks  at  trial.  Never  put  anything  in  an  e-mail 
you  wouldn’t  want  your  mother  to  read.” 

-PATRICK  oof  VERIZON  DIRECTOR  OF  E-DI6C0VERY 


meet  document  preservation  and  produc¬ 
tion  obligations.” 

Such  preparation  makes  you  “discov¬ 
ery  ready”  rather  than  needing  to  react 
to  litigation  or  regulatory  investigations 
as  they  come  up,  according  to  Mark 
Reichenbach,  the  former  director  of  dis¬ 
covery  and  regulatory  response  at  Mer¬ 
rill  Lynch,  now  vice  president  for  client 
and  industry  development  with  vendor 
MetaLincs.  Some  companies  have  even 
begun  to  appoint  cross-functional  e-dis¬ 
covery  teams  to  address  the  issue,  adds 
Zazzera,  run  either  by  IT  or  the  general 
counsel’s  office. 

2.  MEET  THE  E-SHREDDER 
Not  everything  needs  to  be,  or  should 
be,  retained.  For  example,  if  the  statute 
of  limitations  has  passed  in  a  tax  case  or 
environmental  dispute,  delete  the  asso¬ 
ciated  records.  Many  companies  keep 
data  from  legacy  systems  that  are  obso¬ 
lete,  so  there’s  no  business  reason— and 
probably  no  legal  reason— to  keep  them 
around,  observes  Julie  Brickell,  associate 
general  counsel  at  Altria  Corporate  Ser¬ 
vices,  which  handles  tobacco  litigation  for 
affiliate  Philip  Morris. 

Defining  what  you  should  preserve 
is  a  murky  issue,  however,  and  depends 
on  what  kind  of  business  you’re  in.  Most 
important,  says  Zazzera,  is  to  have  a  con¬ 
sistent  policy  for  what  is  and  what’s  not 
permissible  to  delete.  Having  an  estab¬ 
lished  policy  that’s  broadly  communi¬ 
cated— and  following  it— indicates  to  the 
courts  that  you’re  taking  the  issue  seri¬ 
ously  and  provides  a  measure  of  protec¬ 
tion  against  accusations  of  carelessness  or 
malicious  intent.  A  policy  is  a  set  of  rules. 
Have  the  same  rules  for  e-mail  as  for  other 
electronic  documents. 

“You  really  have  to  think  through  a 
policy  about  everything,”  Zazzera  says. 
“What  records  you’re  keeping  and  how 
you’re  keeping  them.” 

Most  companies  will  say  that  all  elec¬ 
tronic  and  paper  documents  generated 
by  employees  on  company  property  can 
become  part  of  the  e-discovery  record. 
But  there  are  gray  areas.  For  example,  if 
a  person  sends  a  personal  e-mail  using  a 


company  computer,  should  that  be  turned 
over  in  e-discovery?  And  if  a  person  sends 
e-mail  from  his  own  computer  about  com¬ 
pany  business,  can  it  be  protected? 

3.  KNOW  WHERE  THE  E-MAILS  ARE 
Have  a  map  showing  the  location  of  every 
e-mail  you  keep  and  how  to  retrieve  it. 
Make  sure  the  IT  department  and  business 
units  know  where  to  find  the  material. 

Howrey  centralized  all  its  e-mail  serv¬ 
ers  in  one  data  center  in  Virginia,  includ¬ 
ing  e-mail  from  its  office  in  Taiwan, 
according  to  CIO  Brian  Conlon.  Data 
from  its  offices  in  Europe  is  consolidated 
in  London.  Storing  all  e-mail  in  just  a  few 
places  makes  it  easier  to  comply  quickly 
with  discovery  orders.  The  law  firm  also 
expects  to  apply  technology  to  help  it  cata¬ 
log  its  paper  files.  In  the  next  year,  Conlon 
plans  to  deploy  radio  frequency  identifi¬ 
cation  (RFID)  to  find  paper  documents, 
which  could  make  it  much  easier  to  search 
for  hard  copies. 

In  addition,  make  e-discovery  compli¬ 
ance  part  of  your  due  diligence  if  your 
company  is  planning  an  acquisition.  Look 
at  the  company’s  e-mail  storage  plan  to 
make  sure  you  will  be  able  to  produce  all 
electronic  data  without  a  glitch  if  there  is 
a  lawsuit  down  the  line. 

4.  TRAIN  YOUR  PEOPLE 

Make  sure  everyone  in  the  company 
knows  which  materials  to  keep  and  which 
to  discard.  “It’s  reasonable  for  a  corpora¬ 
tion  to  rely  on  employees  to  save  docu- 


What  About  IM? 


Will  the  courts  require  IM  records?  PDA 
communications?  Check  out  the  NEW 

RULES  at  www.cio.com/article/27958. 

cio.com 


ments  that  might  be  in  litigation,”  asserts 
Howrey’s  Rosenthal. 

If  you  have  a  personal  e-mail  policy  in 
your  office  (and  you  should),  make  sure 
employees  know  what  kind  of  messages 
should  never  be  sent  from  an  office  com¬ 
puter.  It  may  be  OK  to  talk  about  your  dog 
or  what’s  for  dinner,  but  a  disparaging 
remark  about  a  person  or  another  com¬ 
pany  may  come  back  to  haunt  you. 

All  e-mail,  both  personal  and  corpo¬ 
rate,  creates  a  potential  litigation  risk, 
says  Patrick  Oot,  Verizon’s  director  of 
electronic  discovery.  “Employees  should 
realize  the  lack  of  privacy  in  e-mail.  If 
executives  imagine  their  e-mails  blown 
up  on  a  highway  billboard,  that’s  exactly 
how  it  looks  at  trial,”  Oot  says.  He  offers  a 
rule:  “Never  put  anything  in  an  e-mail  you 
wouldn’t  want  your  mother  to  read.” 

5.  TECHNOLOGY  IS  YOUR  FRIEND 
Get  used  to  the  idea  that  supporting  e-dis¬ 
covery  is  a  necessary  expense.  You’ll  pay 
a  premium  if  you  wait  until  a  lawsuit  hits 
before  you  prepare  to  comply. 

There  are  e-discovery  tools  designed 
to  meet  the  needs  of  any  company,  from 
startups  to  large  multinationals.  How 
much  you  spend  has  a  lot  to  do  with  how 
much  discoverable  information  you  have 
and  the  number  of  concurrent  litigations 
you  usually  face.  You  also  have  the  choice 
of  outsourcing  instead  of  deploying  the 
technology  yourself.  But  a  basic  system, 
according  to  Zazzera,  includes  search  and 
retrieval  software  as  well  as  archiving 
capabilities. 

None  of  this  is  glamorous  or  fun. 

But  it  is  necessary.  BE] 


Judi  Hasson  is  a  freelance  technology  writer.  To 
comment  on  this  story,  go  to  www.cio.com/ 
article/149850. 
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We  have  one  thing  to  say  to  everyone  who 
believes  a  SINGLE  platform  can't  change 
EVERYTHING  about  data  management. 
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tion  modules  for  Data  Protection,  Archive,  Replication,  Resource  Management  and 
Search — all  built  from  the  ground  up,  on  a  single  code  base  and  platform.  The  Result? 
Singular  efficiency,  flexibility,  and  scalability  other  products  can  only  dream  about.  To 
learn  why  Simpana  software  will  change  the  way  you  think  about  data  management, 
and  about  the  groundbreaking  new  features  and  search  capability  in  Simpana  7.0 
software,  visit  www.commvault.com  today. 
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Business  Process  Management 


Making 
Workflow 
Work  Flow 
for  You 


Workflow  isn’t  rocket  science, 
but  it  isn’t  magic  either. 

It  can  improve  the  way  your 
organization  runs  only 
if  you  apply  its  principles 
correctly. 

BY  RICK  COOK 


OTTOM  LINE:  ADDING  WORK- 
flow  to  a  process  saves  money.  It 
increases  customer  satisfaction. 
It  helps  business  get  results  more 
quickly  and  largely  eliminates  the 
problem  of  steps  getting  skipped  and  factors 
being  missed  in  the  old  project  shuffle. 

In  other  words,  what’s  not  to  like? 

“With  workflow,  the  process  is  really  in 
focus,”  says  Wilhelm  Ederyd,  a  technical  project 
manager  at  Bonver,  a  Scandinavian-based  dis¬ 
tributor  of  home  entertainment  products.  The 
true  goal  of  workflow,  Ederyd  says,  is  “hiding 
unnecessary  complexity  from  the  users.”  (For 
more  on  the  issue  of  complexity,  see  “Cures  for 
Complexity,”  Page  46.) 

But  what  exactly  is  workflow? 

Workflow  in  Action 

One  can  think  of  workflow  as  systems  analy¬ 
sis  that  focuses  on  people  and  machines  and 
their  interaction  rather  than  focusing  just  on 
numbers.  Ederyd,  for  example,  working  then 
as  a  consultant  for  Bonver,  had  to  build  sup¬ 
port  for  people  and  businesses  ordering  broad¬ 
band  services  from  Bonver  via  the  Web,  e-mail 
and  snail  mail.  “This  can  be  a  rather  complex 
process,  with  the  systems  and  personnel  need¬ 
ing  to  interact  efficiently  in  order  to  make  the 
process  slim  and  pleasant  to  the  customer,” 
Ederyd  explains. 

In  this  case,  Ederyd  designed  the  process  for 
ordering  and  installing  the  broadband  connec¬ 
tion  for  the  customer.  Typically— given  a  whole 
raft  of  business  requirements  generated  by 
Bonver’s  executives— that  means  working  out 
how  the  process  would  flow  from  the  customer’s 
initial  contact  with  Bonver  to  the  actual  installa¬ 
tion:  Who  does  what?  What  does  the  IT  system 
do?  When  should  decisions  be  made  and  who 
should  make  them? 

Ederyd  presents  a  classic  workflow  case: 
a  complex,  multistep 
process  where  comput¬ 
ers  and  people  have  to 
interact  as  smoothly 
and  efficiently  as  pos¬ 
sible.  It’s  also  a  process 
that’s  exposed  to  the 
customer,  and  there¬ 
fore  delays  or  mistakes 
could  damage  Bonver’s 


Reader  ROI 

::  What  level  of 
workflow  you  need 

::  How  workflow 
differs  from 
business  process 
management 

::  Best  practices 
for  implementing 
workflow 
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Business  Process  Management 


relationship  with  its  customers. 

For  Defense  Health,  an  Australian 
insurance  company,  customer  rela¬ 
tionships  are  particularly  important. 
“We  needed  a  system  that  would 
let  us  answer  a  customer’s  ques¬ 
tion  up  front  rather  than  saying, 
‘We’ll  call  you  back,”’  says  Andrew 
Guerin,  COO  of  Defense  Health.  For 
Guerin,  that  meant  having  processes 
in  place  to  access  information  as 
quickly  as  possible.  Using  workflow 
tools  from  OpenText,  the  company 
designed  processes  that  combined 
IT  systems,  documents  and  people 
and  got  a  handle  on  queries  much 
more  quickly,  which  makes  for  a 
satisfied  customer. 

Rightsizing 

Workflow 

Workflow  tools  are  highly 
stratified.  At  the  top  of  the 
range  are  the  workflow 
modules  built  into  ERP 
applications  such  as  SAP 
and  standalone  products 
like  FlowWare  from  Plexus. 

Products  in  this  class  typi¬ 
cally  include  process  modeling,  busi¬ 
ness  rules  engines  and  other  features 
to  help  reengineer  processes  involving 
thousands  of  workers  and  thousands— 
or  tens  of  thousands— of  steps. 

At  the  entry  end  of  the  spectrum, 
applying  workflow  to  the  simplest  pro¬ 
cesses  requires  no  special  tools  at  all. 
“I  have  pointed  out  to  some  users  that 
what  they  really  wanted  is  Microsoft 
Office  and  a  little  routing  slip  between 
users,”  says  Johannes  Scholtes,  presi¬ 
dent  of  ZyLAB  Technologies,  a  work- 


Workflow? 

BPM? 

I’m  So 
Confused! 

The  difference 
between  workflow 
and  business 
process 
management 

WHEN  TRYING  TO  TWIG  APART 
workflow  and  BPM,  one  is  apt  to  fall 
into  the  Wonderland  of  vendor  speak. 
Vendors  that  advertise  themselves 
as  being  in  the  BPM 
space  are  aiming  to 
sell  their  products 
to  large  companies 
undertaking  big, 
complex  projects. 
Those  that  call  their 
products  "workflow” 
are  selling  to  smaller 


flow  vendor  and  consultant.  “Of  course, 
you  can  sell  these  people  a  $25,000 
application  to  automate  this,  but  they 
don’t  really  need  it.” 

Ultimately,  what  you  need  depends 
on  the  size  and  complexity  of  the  pro¬ 
cesses  to  which  you’re  trying  to  apply 
workflow  management. 

Features  aren’t  the  only  differences 
between  workflow  tools.  The  products 
aimed  at  simpler  processes  usually 


or  mid-market  companies. 

In  truth,  workflow  is  the  basis  of 
BPM  as  well  as  business  reengineer¬ 
ing.  In  other  words,  BPM  is  simply 
workflow  with  a  lot  of  bells  and 
whistles. 

But  those  bells  and  whistles  are 
important  enough  to  make  a  big  dif¬ 
ference  for  someone  trying  to  help  a 
business  run  more  efficiently.  A  typi¬ 
cal  BPM  application  has  elaborate 
modeling  tools,  analytical  functions 
and  other  features  to  handle  com¬ 
plex  projects  that  workflow  is  not 
generally  thought  to  possess. 

That,  however,  may  be  changing. 
Workflow  trade  groups,  such  as  the 
Workflow  Management  Coalition, 
are  busy  developing  tools  for  large 
projects,  such  as  an  XML-based 
process  definition  language.  Per¬ 
haps  the  best  way  to  look  at  the 
BPM-workfiow  dichotomy  is  that  the 
terms  overlap  so  much  that  it’s  vir¬ 
tually  impossible  to  draw  any  kind  of 
a  hard  line  between  them— not  that 
vendors  don’t  try  strenuously  to 
do  so.  -R.C. 


focus  on  ease  of  use.  The  designers’ 
assumption  is  that  the  product’s  ulti¬ 
mate  users  will  not  be  experts. 

For  example,  Quask,  a  workflow 
software  vendor,  built  its  application 
around  the  concept  of  an  intelligent 
form.  The  user  develops  the  work- 
flow  by  filling  in  the  form,  including 
the  business  rules.  “Everyone  under¬ 
stands  what  a  form  is,”  says  Quask 
CEO  Freddy  May.  “People  can  relate  to 


“Once  you’re  comfortable  with  workflow  in  your 
organization,  it  will  allow  you  to  implement 
new  business  models  much  faster  than  your 
competition.” 

-WILHELM  EDERYD,  BONVER  TECHNICAL  PROJECT  MANAGER 
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Legendary  Reliability® 


Introducing  the  revolutionary  enterprise  architecture 
that  finally  pays  you  back. 

Legacy  systems  work  fine  for  brute-force  cooling  the  entire  room,  but  skyrocketing 
energy  costs  make  them  fiscally  irresponsible  and  their  fundamentally  oversized 
design  makes  them  incapable  of  meeting  today's  high-density  challenges. 

Even  worse,  power  and  cooling  waste  may  actually  prevent  you  from  purchasing 
much-needed  new  IT  equipment.  Simple  problem,  simple  solution.  Cut  your  power 
and  cooling  costs  and  use  the  savings  to  buy  the  IT  equipment  you  need. 

According  to  Gartner  Research,  50%  of  all  data  centers  built  before  2002  will 
be  obsolete  by  2008  because  of  insufficient  power  and  cooling  capabilities. 

Power  and/or  cooling  issues  are  now  the  single  largest  problem  facing  data 
center  managers. 

There's  only  so  much  power  and  money  to  go  around 

Your  service  panel  limits  the  amount  of  power  available.  Your  budget  limits  the 
amount  of  money.  You  have  to  stretch  every  bit  of  both  as  far  as  you  can. 

What  you  need  is  the  APC  Efficient  Enterprise™ 

The  APC  solution  offers  modular  scalability  so  that  you  pay  only  for  what  you 
use;  capacity  management  so  that  you  know  where  to  put  your  next  server;  and 
dedicated  in-row  and  heat-containment  systems  that  improve  cooling  and  thermal 
predictability.  An  Efficient  Enterprise  earns  you  money  through  the  pre-planned 
elimination  of  waste.  For  example,  simply  by  switching  from  room-  to  row-oriented 
cooling,  you  will  save,  on  average,  35%  of  your  electrical  costs. 


The  Efficient  Enterprise “  makes  cooling  predictable  and  reduces 
operational  expenses  by... 

(7)  Employing  close-coupled  cooling.  Our  innovative 
InRovZ"  architecture  allows  more  efficient,  targeted 
cooling  by  shortening  the  distance  between  heat  generation 
and  heat  removal. 

(?)  Containing  the  heat  Our  Hot  Aisle  Containment  System 
reduces  hot  spots  by  preventing  hot  exhaust  air  from  mixing 
with  cool  air  in  the  room. 

(?)  Managing  capacity.  Intelligent,  integrated  capacity 
management  software  gives  you  real-time  data  on  your 
power  and  cooling  demands. 

@  Utilizing  right-sized  components,  flight-sized  "pay  as 
you  grow "  components  mean  no  more  wasting  power  with 
oversized  legacy  systems. 


Our  system  reimburses  you 

Whether  you're  building  a  new  data  center  or  analyzing  the  efficiency  of  existing 
systems,  your  first  step  is  knowing  where  you  stand.  Take  the  online  Enterprise 
Efficiency  Audit  to  see  how  you  can  reap  the  benefits  of  a  smart,  integrated, 
efficient  system:  more  power,  more  control,  more  profits. 
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The  division  between  big  and  complex  and  simple  and  small  is 
somewhat  misleading.  Almost  any  process  can  be  broken  down 
into  a  series  of  smaller  processes,  so  it’s  possible  to  handle  even 
a  large,  complex  process  by  chopping  it  into  chunks  and  doing 

it  one  chunk  at  a  time. 


it  instantly.” 

Products  designed  for  larger  projects 
are  much  less  concerned  with  ease  of 
use.  Vendors  expect  that  the  products 
will  be  used  by  consultants  or  in- 
house  experts. 

The  division  between  big  and  com¬ 
plex  and  small  and  simple  is  important, 
but  it’s  also  somewhat  misleading.  As 
almost  any  process  can  be  broken  down 
into  a  series  of  smaller  processes,  it’s 
possible  to  handle  even  a  large,  complex 
process  by  chopping  it  into  chunks  and 
doing  it  one  chunk  at  a  time. 

The  limitations  of  the  simpler  work- 
flow  tools  become  evident  when  they’re 


When 
Workflow 
Neither 
Works  Nor 
Flows 

Trouble  spots  to  watch 
out  for: 

No  plan.  "It’s  a  mistake  to  buy 
a  product  without  thinking  through 
who’s  going  to  carry  out  the  imple¬ 
mentation,”  says  Freddy  May,  CEO  of 
workflow  software  vendor  Quask.  That 
could  be  your  IT  staff,  a  consultancy 
or  the  vendor.  The  point  is:  Decide  on 
your  plan. 

No  process.  By  definition, 
workflow  applies  to  a  process.  But  a 
process  is  not  a  collection  of  random 


asked  to  manage  interprocess  depen¬ 
dencies  and  handle  complex  database 
integration  and  tasks  that  are  critical 
to  larger,  more  complex  processes.  The 
complexity  cuts  both  ways.  A  big  proj¬ 
ect  requires  the  tools  that  come  with  a 
big,  expensive  product.  But  if  you  don’t 
need  that  big,  expensive  product,  the 
complexity  that  comes  along  with  it 
can  slow  you  down. 

The  Workflow 

Advantage 

Unlike  ERP,  workflow  tends  to  use  a 
bottom-up  approach  to 
reorganizing  the  enterprise. 


business  activities— it’s  a 
stream  of  activities  con¬ 
nected  in  a  specific  order. 

If  what  you're  trying  to 
improve  with  workflow 
isn’t  an  actual  process,  you’ll  end  up 
with  a  dysfunctional  mess. 

Also,  be  sure  the  process  is  ame¬ 
nable  to  workflow.  “You  should  not  try 
to  automate  activities  that  are  too  flex¬ 
ible,”  says  Wilhelm  Ederyd,  a  technical 
project  manager  at  Bonver,  a  distribu¬ 
tor  of  home  entertainment  products. 
“If  you  do,  the  solution  will  be  useless 
to  the  end  users.  The  workflow  is  too 
rigid  and  will  not  allow  them  to  per¬ 
form  their  jobs.” 

No  humility.  “Don’t  try  to 
implement  the  perfect  process  from 
the  start  or  you’ll  get  bogged  down 
with  the  complexity,  and  your  users 
and  management  might  lose  interest 
in  the  project,”  says  Ederyd.  Experts 
say  to  shoot  for  85  percent  to  90  per- 


It  works  one  process  at  a  time. 

In  a  typical  organization,  workflow 
implementations  are  atomic.  While 
a  process  may  be  connected  to  other 
processes  in  an  elaborate  chain  or  net¬ 
work,  each  process  is,  in  effect,  a  sepa¬ 
rate  project.  This  is  in  contrast  to  ERP, 
which  deals  with  the  organization  as  a 
whole— and  that  “whole”  needs  to  be 
carefully  modeled  before  changes  are 
contemplated. 

The  disadvantage  of  the  workflow 
approach  is  that  it  takes  a  while  to  fully 
reengineer  an  organization.  ERP  tries 
to  swallow  the  elephant 
in  one  gulp.  Applying 


cent  of  the  business 
requirements. 

No  value,  it’s 
easy  to  waste  money 
applying  workflow  to 
processes  that  return  minimal  or  no 
value  for  being  improved.  It’s  vital  to 
pick  your  targets  carefully— especially 
in  the  beginning. 

No  buy-in.  Implementing  work¬ 
flow  means  combining  systems  and 
people.  If  your  people  don’t  under¬ 
stand  the  process  or  its  benefits,  why 
should  they  cooperate? 

No  SCOpe.  While  your  ultimate 
goal  may  be  to  improve  every  process 
in  your  organization,  starting  small 
and  building  block  by  block  decreases 
risk  and  improves  your  chance  of 
success. 

“If  you  start  with  20  or  30  pro¬ 
cesses,  you’re  missing  out  on  the 
opportunity  to  learn  on  the  job,” 
says  May.  -R.C. 
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BUYING  MORE 

SOFTWARE. 


ITS  ABOUT 

GETTING  MORE 

VALUE. 


Growing  your  business  doesn't  have  to  mean  spending  more  money  on  software. 
Shift  resources  from  managing  and  maintaining  to  innovating  and  driving  business 
strategies.  See  how  Red  Hat  is  redefining  IT  value  for  organizations  every  day. 
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Business  Process  Management 


workflow  to  an  entire  orga¬ 
nization  is  like  trying  to  eat 
the  elephant  one  bite  (or 
process)  at  a  time. 

When  the  elephant  gets 
to  a  certain  size,  the  more 
advanced  business  pro¬ 
cess  management  (BPM) 
tools  come  into  play.  (See 
“Workflow?  BPM?  I’m  So 
Confused,”  Page  72.) 

The  advantage  of  the  workflow 
approach  is  that  IT  is  not  as  locked  in 
during  implementation.  Changes  to  a 
workflow  process  can  be  made  quickly. 
“Once  the  system  is  in  place,  it’s  not  the 
be-all  and  end-all,”  says  Craig  Cameron 
of  Web  and  Flo,  a  workflow  consul¬ 
tant  and  maker  of  workflow  software. 
Change  in  business  is  inevitable.  That’s 
one  of  the  problems  with  ERP;  it’s  so 
difficult  to  adapt. 

Another  advantage  of  a  well- 
designed  workflow  process  is  that  it  can 
serve  as  a  template  that  can  be  applied 
quickly  to  similar  processes.  “Once 
you’re  comfortable  with  workflow  in 
your  organization,  it  will  allow  you  to 
implement  new  business  models  much 
faster  than  your  competitors,”  says 
Bonver’s  Ederyd.  “The  cost  and  com¬ 
plexity  of  doing  so  is  now  manageable.” 
(For  signs  that  your  implementation  is 
going  wrong,  see  “When  Workflow  Nei¬ 
ther  Works  Nor  Flows,”  Page  74.) 

Cameron  cites  the  example  of  a  cus¬ 
tomer,  an  Australian  bank,  that  wanted 
to  apply  workflow  to  the  process  that 
some  of  its  divisions  used  to  order 
hardware.  “They  needed  to  go  through 
all  these  checks  and  make  sure  that 
the  right  people  had  signed  off  on  it,” 
Cameron  says.  “So  we  implemented  a 
system  to  do  that.” 

Which  was  fine  until  the  bank’s  other 


Workflow  and  BPM 


Puzzled  by  how  to  integrate  workflow 
with  BUSINESS  PROCESS  MANAGE¬ 
MENT?  Go  to  www.cio.com/article/ 
151002  to  see  what  the  Aberdeen 
Group  has  found  out.  rm  nru 


divisions  heard  about 
the  new  process.  “We 
only  created  a  system 
for  three  or  so  of  their 
teams,  and  suddenly 
another  IS  wanted  to 
be  involved,”  Cam- 
eron  says.  “Instead  of 
having  to  do  a  com¬ 
plete  restart,  we’re 
extracting  what  we’ve  already  done 
and  cutting  and  pasting  it  into  a  new 
system.  Then  we  hit  a  button  to  create 
the  end  user  interface.” 


“A  complex 
solution  often 

indicates  you 
aretryingto 
support  goals 
other than 

and  this  will 
add  risk  to  the 

project.” 

-WILHELM  EDERYD, 
BONVER  TECHNICAL 
PROJECT  MANAGER 


Where  and  How 
Do  You  Start? 

There  are  several  elements  common  to 
all  successful  workflow  implementa¬ 
tions: 

Start  simple.  “A  workflow  imple¬ 
mentation  should  be  as  simple  and 
robust  as  possible,”  says  Ederyd.  “A 
complex  solution  often  indicates  you 
are  trying  to  support  goals  other  than 
those  defined,  and  this  will  add  risk  to 
the  project.” 

Talk  to  the  users.  “Active  user 
involvement  is  a  key  to  success,”  says 
Ederyd.  “You  really  need  to  sit  down 
with  the  users  and  watch  and  question 
how  they  perform  their  tasks  in  order  to 


identify  the  scope  for  the  solutions.” 

ZyLAB  Technologies’  Scholtes  rec¬ 
ommends  getting  use  cases  from  users. 
“The  only  way  we’ve  been  successful 
is  to  talk  to  the  end  users  and  try  to  get 
some  use  cases  on  paper,”  he  says. 

Define  the  process.  “The  biggest 
problem  is  knowing  what  you  want,” 
says  Scholtes.  “People  often  work  dif¬ 
ferently  from  how  they  think  they  work. 
With  workflow,  you’ve  got  to  really  pin 
people  down.” 

Draw  pictures.  In  the  world  of 
workflow,  these  are  known  as  “visual 
process  models.”  They  represent  the 
process  and  the  roles  of  the  various 
affected  groups  in  a  simple,  easy-to- 
understand  format. 

“Diagrams  are  critical,”  says  Quask’s 
May,  even  if  the  process  is  trivial.  “What 
a  diagram  does  is  basically  prove  you’ve 
thought  about  what  you’re  doing.  The 
temptation  is  always  to  say,  ‘I  know  how 
this  works.’  More  often  than  not,  you 
don’t,  because  you  haven’t  taken  the 
time  to  analyze  the  process.” 

Pay  attention  to  exceptions.  The 
nature  of  processes  is  that  people  judge 
them  more  by  what  goes  wrong  rather 
than  by  what  goes  right.  “You  need  to 
make  sure  that  the  inevitable  exceptions 
are  handled  smoothly,”  says  Ederyd. 
“A  lot  of  customer  dissatisfaction  is 
based  on  how  clumsily  exceptions 
are  handled.” 

Pilot  and  test.  Make  sure  the  process 
works  before  you  rely  on  it.  Some  orga¬ 
nizations  run  the  old  and  new  methods 
in  parallel  until  they  are  satisfied  with 
the  workflow  implementation. 

Workflow  isn’t  rocket  science,  but 
it  isn’t  magic  either.  While  workflow 
can  make  major  improvements  in  the 
way  an  organization  runs,  it  can  only 
do  so  if  the  principles  are  applied  cor¬ 
rectly.  Making  workflow  work  and 
flow  for  you  comes  down  to  under¬ 
standing  the  processes  that  make  your 
business  work.  BZ3 


Rick  Cook  is  a  freelance  technology  writer. 
To  comment  on  this  article,  go  to  www.cio 
.com/article/148309. 
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Does  it  seem  your  servers  are  taking  over? 
Let  CDW  help  you  regain  control. 


Hard  drives 
sold  separately 


HP  ProLiant  DL580  G4  Rack-mount  Server 

•  Dual-Core  Intel®  Xeon®  Processors  7140  M  (3.40GHz) 

•  Memory:  4GB  std.,  64GB  max.  (PC2-3200) 

•  Data  storage:  none  ship  std.;  up  to  eight  hot-pluggable  SAS  (576GB) 

•  32MB  Level  3  Cache  (16MB  per  processor) 

•  Embedded  Dual  NC373i  Multifunction  Gigabit  network  adapters 

•  Dual  hot-pluggable  redundant  power  supply 


Call  CDW  for  pricing  CDW  1 038995 


VMware®  Infrastructure  3  Enterprise 
for  Two  Processors 

•  Increases  hardware  utilization 

•  Decreases  hardware  and  software  capital  costs 

•  Improves  server  to  server  administrator  ratio 

Call  CDW  for  pricing  CDW  994419 


vmware 


Hard  drives 
sold  separately 


HP  StorageWorks®  70  Modular  Smart  Array 

•  Low-cost,  flexible  tiered  storage  system  with  up  to 
14.4TB  capacity  supporting  both  SAS  and  SATA 

•  Scalable  design  allows  you  to  purchase  additional 
capacity  as  storage  needs  grow 

Call  CDW  for  pricing  CDW  1126579 


We're  there  with  the  server  solutions  you  need. 

Is  managing  your  growing  number  of  servers  and  your  growing  storage  needs  getting  to  be 
too  much?  At  CDW,  we're  there  with  everything  you  need  to  optimize  your  servers.  From  server 
consolidation  to  storage  management,  networking  to  virtualization,  CDW  can  answer  your 
questions  and  get  you  the  solutions  you  need.  So  call  today.  It's  time  you  ran  your  network, 
not  the  other  way  around. 

CDW.com  800.399.4CDW 


Offer  subject  to  CDW's  standard  terms  and  conditions  of  sale,  available  at  CDW.com.  ©2007  CDW  Corporation 
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Beyond  the  Spreadsheet 


A  business  sensibility  is  not  just  what  your  IT  staff 
learns  in  an  introductory  MBA  course.  It’s  not  about  how 
to  read  a  spreadsheet  or  build  a  budget.  What  it’s  really 
about  is  thinking  and  acting  like  a  businessperson.  For 
years,  members  of  the  CIO  Executive  Coun¬ 
cil  have  been  concerned  that  their  staffs  lack 
real  business  understanding  in  such  areas  as 
their  company’s  market,  its  external  custom¬ 
ers  and  other  business  drivers.  In  response, 

Council  members  have  created  a  formal  learn¬ 
ing  community— Leadership  Advancement 
Pathways— for  their  direct  reports.  Veteran 
CIOs  act  as  faculty  for  the  yearlong  curricu¬ 
lum.  Pathways  and  other  formal  programs  are 
one  tool  in  the  business  education  portfolio  (see  “All  About 
Training,”  below).  But  staff  must  also  cultivate  an  on-the- 
job  business  sensibility.  To  that  end,  Council  members  are 
immersing  staff  in  the  business  environment. 

You  have  been  invited  to  a  meeting... 

It’s  one  thing  for  IT  staff  to  meet  with  users  and  business 
peers  for  a  project  review.  It’s  quite  another  to  have  staff 
interact  with  senior  business  executives  on  a  regular  basis. 
Cathie  Kozik,  corporate  vice  president  of  supply  chain  IT 
at  Motorola,  invites  her  information  visibility  analyst  to 


participate  in  senior  business  leadership’s  quarter-close 
meetings  so  he  can  see  firsthand  how  the  operational  per¬ 
formance  data  points  he  produces  are  used  to  make  deci¬ 
sions.  “It’s  a  real  aha!  moment,”  says  Kozik.  The  analyst 
takes  what’s  he’s  learned  back  to  his  desk  to 
brainstorm  new  ways  to  slice  the  data  and 
contribute  new  types  of  information  that  will 
have  business  value.  Kozik’s  team  also  regu¬ 
larly  sits  down  with  members  of  the  business 
to  do  a  “look  back”  and  “look  ahead”  on  how 
information  is  being  used  and  how  it  could  be 
used,  says  Kozik. 

Stewart  Gibson,  senior  vice  president  and 
CIO  at  USI  Holdings,  asks  his  senior  staff  not 
just  to  participate  in  IT  steering-committee  meetings  with 
senior  business  leaders,  but  to  actually  run  them.  To  be 
effective,  leaders  really  have  to  know  the  business  and 
speak  the  language,  says  Gibson. 

IT-business  executive  interaction  works  well  even  on 
the  small  scale.  Brian  Tennant,  CIO  at  Bethesda  Lutheran 
Homes  and  Services,  has  eight  individuals  on  his  IT  team. 
“Our  department  is  too  small  to  worry  about  creating  formal 
opportunities  to  increase  business  sensibility,”  says  Ten¬ 
nant.  Instead,  he  routinely  asks  staff  to  join  him  for  meetings 
with  members  of  the  Bethesda  senior  management  team. 

Continued  on  Page  80 
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How  to  Build  a  Business  Sensibility 


CIOs  complement  on-the-job 
opportunities  with  programs 
from  a  wide  variety  of  sources. 

»  CIO  Bruce  Metz  at 
Thomas  Jefferson  University 
created  a  customer  service 
program  that  teaches  how  to 
understand  customers  and 
manage  customer  interac¬ 
tions.  "We  used  a  professional 
trainer  to  develop  content 
based  on  direct  feedback 
from  the  business  units,” 


says  Metz.  The  trainer  facilitated  the 
two-month  series  of  workshops  for 
all  members  of  the  IT  department. 
(Download  the  curriculum  outline  at 
www.cioexecutivecouncil.com/pub- 
lic/content.html.) 

»  CIO  and  SVP  Stewart  Gibson 
at  insurance  broker  USI  Holdings 
encourages  his  business  analysts 
to  get  nontechnical  certifications  in 
property  and  casualty  insurance  and 
insurance  licenses.  He  builds  funding 
for  both  into  his  annual  budget. 


»  With  CIO  Scott  Wesson’s  spon¬ 
sorship,  Vice  President  of  IT  Strategy 
Michael  Baldwin  participates  in  the 
CIO  Executive  Council’s  Leadership 
Advancement  Pathways  program, 
where  he  can  speak  with  CIOs  and 
his  peers  from  other  industries  about 
advanced  business  competencies. 
"Every  time  I  talk  to  someone  outside 
of  AIMCO,  I  increase  my  business 
acumen  and  am  able  to  pinpoint 
more  variables  affecting  our  busi¬ 
ness,”  says  Baldwin.  -C.M. 
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SunGard.  Setting  new  standards  for 
Information  Availability  by  delivering 
a  range  of  solutions  that  meet  your 
specific  availability  objectives.  Flexible 
enterprise  wide  solutions  from  IT 
management  to  AdvancedRecoverySM. 
2,500  experts.  Three  decades  of 
experience.  100%  successful 
recovery  track  record. 

To  see  how  SunGard  can  help 
improve  your  IT  availability  stop 
by  www.availability.sungard.com 
or  call  800-871-5857  today. 


SUNGARD’ 

Availability  Services 


Keeping  People 
and  Informal  ion 
Connected 


680  East  Swedesford  Road,  Wayne  PA  19087 
800-468-7483  |  www.availability.sungard.com 


TO  SEE  THE  TOP  SEVEN  ROADBLOCKS  COMPANIES  FACE  IN  ACHIEVING  INFORMATION  AVAILABILITY 


AND  FIND  OUT  HOW  TO  AVOID  THEM  VISIT  WWW.AVAILABILITY.SUNGARD.COM/IA. 
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BUSINESS  MIND-SET 


[experience  base] 


A  Structure  That 
Means  Business 


Motorola's  new  organizational  structure 
for  IT  staff  divides  them  into  three  specific 
teams:  “Plan,"  composed  of  business 
analysts  who  interface  with  the  rest  of  the 
business:  "Build,”  the  application  develop¬ 
ers;  and  “Run,”  the  maintenance  staff. 

Cathie  Kozik,  corporate  vice  president 
of  supply  chain  IT,  was  one  of  the  first 
adopters  of  this  model.  She  made  stra¬ 
tegic  hiring  decisions  and  moved  IT  staff 
with  advanced  business  skills  onto  the 
right  team.  She  also  hired  businesspeople 
directly  into  IT,  specifically  onto  the  Plan 
team,  which  helped  the  rest  of  the  team  get 
up  to  speed  on  the  business  and  intrica¬ 
cies  of  the  functional  areas.  “For  the  Run 
team,  I  have  people  who  sit  with  the  busi¬ 
ness  so  that  they  have  the  same  sense  of 
urgency  about  serving  the  customer  and 
getting  product  out  the  door  as  the  busi¬ 
nesspeople  do,"  says  Kozik. 

Although  the  Build  team  is  positioned 
separately  from  the  rest  of  the  business,  the 
Plan  and  Run  teams  are  colocated  with  the 
business,  inspiring  a  shared  vocabulary. 

"[IT  is]  thinking  every  day  about  volume, 
conversion  costs,  conversion  cycles  and  the 
kinds  of  things  that  matter  to  the  business” 
in  the  supply  chain  area,  says  Kozik. 

One  unintended  consequence  of  con¬ 
necting  Kozik’s  staff  so  tightly  to  their  busi¬ 
ness  partners  is  that  project  demand  rate 
has  increased  significantly.  "We  now  have 
people  directly  connected  to  the  business 
to  hear  and  foster  ideas  and  thoughts. 
Previously,  the  business  would  have  lots  of 
ideas  but  did  not  have  time  to  bring  them 
to  us  since  it  meant  arranging  special 
meetings,”  says  Kozik.  She  tries  to  keep 
the  number  of  projects  under  control  by 
aligning  investment  planning  with  Motoro¬ 
la’s  overall  strategy. 
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Beyond  the  Spreadsheet 

Continued  from  Page  78 


The  benefits  of  these  types  of  meetings  are 
cumulative  as  Tennant’s  team  gets  more 
exposure  to  (and  new  perspectives  on)  the 
business’s  goals.  “After  participating  in 
meetings  with  the  CFO,  my  programmer 
will  go  back  to  his  desk  and  rethink  the  way 
we  deliver  financial  data.  He  thinks  about 
what  the  CFO  is  trying  to  accomplish  and 
the  intended  audience,”  says  Tennant. 


STEWART 

GIBSON 


Business  101  tour  now  departing 

At  AIMCO,  CIO  Scott  Wesson  always  tells  his  new  hires,  “You  can 
never  forget  what  the  A  in  AIMCO  stands  for.”  It  stands  for  “apart¬ 
ments”;  that’s  what  the  $1.5  billion  real  estate  management  company 
is  all  about.  Wesson  routinely  takes  new  hires  out  to  a  Denver-area 
apartment  building  to  get  a  sense  of  the  business.  He  used  to  take  staff 
on  a  tour  of  the  facility  and  call  it  a  day;  now  he  takes  the  field  trip  a 
step  further.  He  invites  a  business  leader  to  run  the  tour  and  talk  about 
what  success  looks  like  from  his  or  her  perspective.  “It’s  become  more 
of  a  dialog  around  business  challenges,  which  gets  the  IT  staff  focused 
immediately  on  business  and  customer  needs,”  says  Wesson. 

Besides  learning  what  the  business  is  about,  CIOs  want  their  staff 
to  understand  the  impact  of  system  success  and  failure.  “I  want  IT 
to  feel  like  they  are  there  to  serve  a  greater  [business]  purpose  and 
not  just  to  connect  network  cords  to  specific  jacks,”  says  Tennant. 
“If  they  can  take  a  problem  and  think  in  business  terms,  then  that’s 
a  very  different  thought  pattern.”  For  example,  instead  of  seeing  a 
“system  going  down,”  they  should  see  its  impact  on  our  ability  to  get 
people  their  medication,  says  Tennant.  After  such  service  disrup¬ 
tions,  Tennant’s  team  visits  with  the  business  function  most  affected 
by  the  outage  for  a  formal  debriefing.  The  discussion  focuses  on  the 
business  impact  of  the  disruption  rather  than  the  technical  problems. 
“Next,  my  staff  participates  in  a  brainstorming  session  with  the  busi¬ 
ness  about  different  ways  we  can  mitigate  risk— whether  it’s  having 
hard  copies  of  medication  forms  or  communicating  with  our  third- 
party  provider  to  provide  medication  information,”  says  Tennant. 

Gibson  sees  the  change  in  mind-set  in  his  everyday  conversa¬ 
tions  with  his  staff  and  on  paper  in  annual  self-appraisals  and 
project  retrospectives.  “My  team  is  now  assessing  their  activities 
and  success  and  framing  it  in  business  terms,  not  in  technical 
terms,”  says  Gibson.  When  I  see  this  shift  in  communication,  I 
know  that  everything  we’re  doing  to  foster  business  sensibility 
is  working.”  QQ 


Carrie  Mathews,  Group  Manager,  Member  Services,  can  be  reached  at  cmathews@ 
cxo.com.  To  comment  on  this  article,  go  to  www.cio.com/author/101060. 


The  CIO  Executive  Council  is  a  professional  organization  for  CIOs  founded  by  CIO’s  publisher.  To  learn  more  about  the  Council, 
visit  www.cioexecutivecouncil.com  or  contact  Vice  President  of  Development  Dexter  Siglin  at  dsigtin@cio.com  or  508  935-4493. 
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CIO 

Exscatm  Pngnmt 

where  you  need  to  be 


CIO  Executive  Programs  combine  cutting-edge  education  and  networking  opportunities  for 
busy  executives.  Our  programs  attract  the  best  and  brightest  IT  executives  and  our  brand 
is  synonymous  with  the  highest  quality  and  integrity.  These  face-to-face  conferences  are 
regarded  as  the  trusted  networking  resource  for  the  nation’s  CIOs  because  we  know  and 
understand  the  executive  IT  community  better  than  any  other  IT  resource. 


CIO  Leadership  Conference 

May  18-20,  2008 
Sheraton  Boston 
Boston,  Massachusetts 

CIO  &  CSO  Business  Continuity  Forum 

July  15-16,  2008 

Marriott  New  York  at  the  Brooklyn  Bridge 
New  York,  New  York 

CIO  100  Symposium  &  Awards 

August  24-26,  2008 
The  Broadmoor 
Colorado  Springs,  Colorado 

ClO|09  The  Year  Ahead 

November  9-1 1 , 2008 
Loews  Coronado  Bay 
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For  more  information 
aod  to  rogistor  visit: 

www.cio.com/exeGUtive-programs 
or  can  800-366-0240 
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some  see  the  awesome  potential  of  business, 
others  see  innovation  powered  by  IT. 


There’s  almost  nothing  that  business  isn’t  capable  of  accomplishing.  Products  that 
make  our  lives  easier.  Ideas  that  change  the  way  we  work.  Breakthroughs  that  extend 
our  lives.  And  who  hasn’t  witnessed  the  power  of  IT  and  its  seemingly  limitless  ability 
to  achieve  what,  just  a  few  years  ago,  was  thought  to  be  impossible?  What  happens 
when  these  two  forces  are  joined  together?  To  find  out,  go  to  ibm.com/special/cio 


■  The  Strategic  CIO  FULFILLING  THE  ROLE'S  NEW  MANDATE 

By  the  leaders  of  the  CIO  Executive  Council 


How  (and  Why)  to 
Understand  Your  Market 

The  CIO  of  Quest  Diagnostics  continually  tests  her  market  savvy  in  order 
to  develop  IT-enabled  products  and  services  that  customers  need 


s  CIO  for  Quest  Diagnostics,  the  diagnostic  testing 

company,  I  not  only  have  to  keep  information  technology  opera¬ 
tions  running,  but  I  also  have  responsibility  to  use  IT  to  create 
competitive  advantage  and  to  deliver  value-added  services 
and  products  for  our  customers.  Developing  market  knowledge— that  is, 
gaining  a  better  understanding  of  the  healthcare  industry  and  our  customers’ 


needs— isn’t  a  sideline  activity.  It’s  part  of  my  role  and 
it’s  critical  to  my  company’s  growth. 

A  broad  and  deep  understanding  of  your  business, 
market  and  customers  enables  you  to  identify  the 
products  and  services  that  will  create  sustained  value 
for  customers  and  sustained  competitive  advantage 
for  your  company.  Such  understanding,  along  with 
knowledge  of  technology  trends,  is  essential  to  align¬ 
ing  IT  and  business  strategies  to  drive  growth. 

As  a  healthcare  company,  we  provide  services  to 
multiple  customers  including  physicians,  hospitals, 
health  plans,  employers,  insurers  and  pharmaceuti¬ 
cal  companies— and  of  course  patients,  who  are  at  the 
center  of  everything  we  do.  Because  we  work  with  all 
of  these  constituents,  we  have  a  360-degree  view  of  the 
healthcare  market  and  its  trends.  Seventy  percent  of 
healthcare  decisions  involve  laboratory  test  informa¬ 


tion,  so  laboratories  such  as  Quest  Diagnostics  are  at 
the  center  of  many  healthcare  IT  initiatives.  We  spend 
a  lot  of  time  with  our  business  partners  and  customers 
understanding  their  needs  and  how  technology  can 
have  the  most  positive  impact. 

Creating  Value-Added  Services 

Here  are  some  examples  of  how  we  have  used  our 
understanding  of  customer  needs  and  market  drivers 
to  deliver  value-added  IT  services: 

We  recognized  that  online  services  could  make  it 
easier  for  patients  and  physicians  to  do  business  with  us, 
and  so  we  identified  and  developed  several  new  Internet- 
based  services.  For  instance,  thousands  of  patients  visit 
our  patient  service  centers  (PSCs)  to  have  blood  drawn 
for  tests.  We  know  that  a  key  factor  in  creating  a  posi¬ 
tive  patient  experience  is  to  minimize  a  patient’s  wait 
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Integration  of  business  and  IT  isn’t  something  that’s  “hopefully”  accomplished  in 
Q... whenever.  As  one  CEO  put  it,  “It’s  as  important  as  water  is  for  sea  traffic.”  And 
since  a  CIO’s  panoramic  view  of  the  business  is  unmatched,  your  role  in  bridging 
this  great  divide  is  critical.  But  how  do  you  actually  do  it?  Where  do  you  start? 


On  the  next  page,  we  begin  to  answer  those  questions.  You’ll  find  insights  from  a 
company  that  has  a  wealth  of  business  process  and  IT  experience.  And  there’s  one 
person  who  can  bring  that  depth  of  knowledge  to  bear  on  your  business.  You.  To 
find  out  more,  go  to  ibm.com/special/cio 


what  makes  you  special? 


e  Strategic  CIO  FULFILLING  THE  ROLE'S  new  mandate 


What  Does  It  Mean 
to  Have  Market  Knowledge? 


Understanding  how  emerging  trends  affect  your  business  is  key 
to  strategic  performance  by  Reynold  lewke  and  steve  kelner 


The  C-level  competency  of  market  knowledge 
is  about  understanding  the  market  context  in 
which  a  business  operates.  Competence  in  mar¬ 
ket  knowledge  is  usually  a  requirement  of  the 
leadership  competencies  of  strategic  orientation,  commercial 
orientation  and  customer  impact. 

At  basic  levels  of  performance,  leaders  understand  obvi¬ 
ous  industry  trends,  the  company’s  products  and  its  custom¬ 
ers.  Middle-level  performers  see  emerging  trends.  At  high 
levels,  leaders  understand  relationships  among  the  various 
elements  of  the  market  and  see  how  trends  could  create  new 
customers,  affect  dealings  with  competitors  and  cause  poten¬ 
tially  profitable  changes. 

CEOs  are  better  at  tracking  competitors  and  industry 
trends  than  are  CFOs.  Both  perform  better  than  CIOs,  who 
are  just  beginning  to  know  their  markets  well. 

Howto  Develop  Market  Knowledge 

Developing  market  knowledge  is  both  easier  and  harder  than 
behavioral  leadership  competencies.  It  is  easier  in  that  per¬ 
forming  at  a  basic  or  middle  level  simply  requires  study.  To 
get  to  the  strategic  level  of  performance,  however,  one  also 
needs  insight,  which  comes  from  understanding  the  depth 
and  breadth  of  the  business,  its  market  and  the  levers  by 
which  these  may  change. 

Are  You  Ready  to  Exercise  Market 
Knowledge? 

Readers  wishing  to  improve  their  performance  in  this  com¬ 
petency  need  to  examine  their  organization’s  readiness,  and 
then  assess  their  own.  Some  questions  to  ask  include: 


How  Key  Execs  Rate  on  Market  Knowledge 


CEOs  are  better  at  tracking  competitors  and  industry 
trends  than  are  CFOs.  Both  perform  better  than  CIOs, 
who  are  just  beginning  to  know  their  markets  well. 


Executive  behavior  legend 


7  =  Sees  how  to  transform  the  industry 

-  6  =  Identifies  emerging  niches/opportunities 

5.2 

5  =  Looks  beyond  current  context 
4  =  Identifies  sub-segments  of  the  market 
3  =  Knows  own  market  well 
2  =  Knows  general  market  basics 
1  =  Knows  immediate  operating  context 

CEO  CIO  CFO 


These  benchmarks  rate  executive  performance  on  a  scale  of  1  to  7.  Plotted 
scores  are  the  average  of  all  scores  from  the  50th  percentile  to  the  85th  percentile 
range  among  executives  rated.  The  data  derives  from  more  than  25,000  executive 
assessments  conducted  by  Egon  Zehnder  International. 


Individual 

□  Do  you  understand  what  drives  the  business  and 
its  market? 

□  Do  you  see  your  role  as  formulating  direction? 

□  Can  you  see  a  situation  from  others’  perspectives 
rather  than  just  your  own? 

□  Can  you  identify  patterns  in  people  and  their  behavior 
as  well  as  in  systems  or  processes? 


Organizational 

□  Does  the  organization  have  an  articulated  strategy  that 
it  follows? 

□  To  what  extent  is  the  organization  market-driven  versus 
technology-driven? 

□  Is  the  business  simple,  or  does  it  include  a  wide  variety 
of  products,  customers  and  business  models?  Is  the 
direction  of  the  business  coherent? 


Based  on  the  answers  to  these  questions,  you  can  decide 
how  to  develop  your  market  knowledge  and  use  it  to  benefit 
yourself  and  your  company.  QQ 


Reynold  Lewke  ( reynold.lewke@ezi.net )  is  Egon  Zehnder’s  North 
American  CIO  Practice  Leader.  Steve  Kelner  ( steve.kelner@ezi.net ) 
is  Global  Knowledge  Leader  of  Egon  Zehnder's  Talent  Management 
and  Management  Appraisal  Practice  Group. 
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steps  toward  integration. 


Translate  IT  into  “business-ese.”  Before  IT 
and  business  can  converge,  IT  and  business 
must  understand  each  other.  So,  rather  than 
using  techno-speak,  explain  in  business  terms 
how  technology  can  positively  impact  the  orga¬ 
nization  and  give  it  a  competitive  advantage. 

Take  down  that  wall.  Decisions  on  how  IT  is 
employed  should  be  made  jointly,  by  both  IT 
and  business  decision  makers.  So  the  walls 
between  those  groups  must  be  removed. 
That  way,  it’s  not  “we-they.”  It’s  “us”  using  IT  to 
shape  and  execute  the  business  strategy. 


Balance  risk  and  reward.  An  IT  portfolio  should 
balance  “run  the  business”  and  “grow  the  busi¬ 
ness”  projects.  The  “run”  projects  keep  your 
current  business  model  working  efficiently.  The 
“grow”  projects,  while  more  complex,  help  you 
expand  into  new  markets  and  product  lines. 

Gain  a  brand-new  perspective.  Your  entire  IT 
organization  would  benefit  from  working  directly 
with  other  business  units  within  the  organiza¬ 
tion.  Once  your  staff  is  acquainted  with  specific 
business  challenges,  they’re  more  likely  to  know 
how  to  use  technology  to  solve  them. 


Now  you’re  four  steps  closer  to  integration.  The  fifth  step?  Choosing  a  partner.  And  we  can  help 
with  that,  too.  If  you  need  someone  with  extensive  integration  experience,  nobody  even  comes 
close  to  IBM.  Our  team  of  over  100,000  delivery  specialists  has  deployed  thousands  of  business 
and  IT  projects  in  multiple  industries.  And  in  many  countries. 

IBM  experts  use  proven  business  modeling  methodologies  to  help  CIOs  decide  which  IT  processes 
drive  the  most  business  value,  and  which  give  you  the  best  competitive  advantage.  Our  financing 
options  turn  up-front  costs  into  affordable  payments.  And  with  a  range  of  outsourcing  solutions,  you 
can  worry  less  about  running  the  business.  So  you  can  focus  on  growing  the  business.  If  your  goal 
is  driving  growth  and  creating  more  collaboration,  we  have  a  suggestion.  Collaborate  with  us. 


We  interviewed  170  CIOs  and  765 
CEOs.  Want  to  know  what  most  CIOs 
considered  their  greatest  obstacle? 
Find  out  at  ibm.com/special/cio 


what  makes  you  special? 


IBM,  the  IBM  logo,  ibm.com  and  What  Makes  You  Special?  are  registered  trademarks  or  trademarks  of  International  Business  Machines 
Corporation  in  the  United  States  and/or  other  countries.  Other  company,  product  and  service  names  may  be  trademarks  or  service  marks  of 
others.  ©  Copyright  IBM  Corporation  2007.  All  rights  reserved. 


Rest  easy. 


You  just  hired  an  (ISC)2®  infosecurity  pro  who  can  help 

eliminate  system  nightmares. 


Even  the  most  experienced  hiring  manager,  can’t  be  expected  to  keep  up  with  the  ever-changing  demands  of 
information  security.  Simply  put,  the  fastest  way  to  keep  pace  with  the  industry  is  to  count  on  (ISC)2 . 


(ISC)2  does  the  heavy  lifting  long  before  a  candidate  knocks  on  your  door.  Our  CISSP®  or  SSCP® 
certification  on  a  resume  means  a  candidate  has  been  reviewed,  tested,  and  qualified.  And  it  doesn’t  stop  there. 
Our  graduates  must  earn  continuing  professional  education  credits  (CPEs)  or  jeopardize  their  credential. 


So  keep  your  eyes  open  for  an  (ISC)2  candidate  and  the  minute  you  find  one  —  sweet  dreams. 
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Before  your  next  hiring  decision,  visit  (ISC)2  for  a  complimentary 
whitepaper,  case  study  and  other  valuable  hiring  resources. 

www.isc2.org/hr07 
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